From what I understand, it'd had been far easier to use a seccomp filter instead. Would have worked with statically linked binaries too.