chroot would probably be sufficient. Barring some sort of code execution vuln in the compiler you can only load stuff off of the filesystem.

Having the actual CPP available is nice because some bits of libc are only macros.