Add some sort of memory allocation management to the scratch space
Expose priv->entered_main, and ignore seccomp until we have actually called execve
Permit some safe syscalls
Simplify event emitting
Map more filenames in syscall, and start handling bind() calls to redirect to local sockets