add a devices cgroup
override the system's hostname
close stdin, stdout and stderr

Otherwise it causes havok with programs trying to print to the screen.
Eventually restore this with pipes.
replace waitpid with signalfd
move to use epoll for polling
send stdout over a pipe
introduce a reliable timeout

Defaults to 5 seconds.