Chroots and ulimits were my solution. Fork a process, chroot it to someplace useless, add a series of extremely restrictive ulimits for memory, open files, cpu and so forth, then have it drop to a nobody user so it can't change them.

If you're interested in working further on this, send me a private message and we can talk specifics.