Do not use pyenv, rbenv, non-root-user whatever language runtime manager.

Build and lock down your runtimes. There should be a sudo chmod -R ugo-w …; sudo chown -R nobody: … somewhere in the build/install process.