People are running custom agents that are able to run custom code in production just like that ?

I’d personally opt for SELinux in such cases