OpenBSD's standard practice is for all daemons to run as unprivileged users in chroots (after using pledge and - nowadays - unveil to restrict themselves further). If one line of code is fd in any of the daemons, it will by default be constrained to that daemon.

Absolutely, and pledge is amazing.

That being said, for example, let’s say pledge or unveil have one line of code that is fd.

You mean as opposed to your container/virtualization having one line of code that is "fd"?

The point of my statement is you have tens upon thousands of lines of code, systems are complex.

You can’t put all your eggs in a basket given the probability that something is fd.

Downvoting my statement is fine as long as it’s noobs learning from this script and not someone who is running critical infrastructure. :)

"You can’t put all your eggs in a basket given the probability that something is fd."

But you'd be doing that no matter what unless you're running each daemon on a different physical machine. That basket's just called "Xen" now instead of "OpenBSD". Worse, if the hypervisor has a bug that can be triggered from unprivileged guest code (i.e. as a non-root user in the guest OS), then any layers added in the guest are moot.

I can see how that kind of makes sense. But if you ask people to run it from multiple machines chances are they will throw their hands up and say too hard and not self host at all?

Agreed and that would be a reason not to self host at all, if security is critical, because it IS difficult.

For example, driving is convenient. That doesn’t mean someone who has never driven before should just drive. It’s definitely better for them to taxi.

It’s a hard problem - we have to make things easier for people.

When King Sejong saw that people were illiterate, he didn’t try to force everyone to suddenly learn a difficult language - he just made an easier one.

Now korea is 99.9% literate.

what is `fd` in this context?

I think he meant "f'd" as in fucked

foobar'd