How to harden Rust servers?

On Linux, it's basically seccomp. It's not ideal (difficult to get all syscalls you need and none that could be abused), but you can set up listening during startup and then block open completely.