we tried the watchdog, but when the file was being constantly updated, the hashing for some reason didn't trip the watchdog. but we can contain it with cgroup. so for now that's the plan, i guess