{
  writeShellApplication,
  pigeon-toolchain
}:

writeShellApplication {
  name = "pigeon-run";
  runtimeInputs = [ pigeon-toolchain ];
  text = ''
    cd /tmp/build
    ulimit -t 1 -u 256 -n 256 -f 2048
    exec setpriv --reuid=65534 --regid=65534 --clear-groups timeout -s 9 2 ./program "$@"
  '';
}