cap error output to avoid running out of memory
executable can reference library even if not sandboxed