I would very much like to hear an answer to that from somebody who understands the subject deeply. Honestly, these days, I use containers for almost anything unusual and I don't update much either - precisely because anything you install with `apt` would have access to ALL of your system or at least limited access in read-only mode for some files and directories. And I would like to know if anyone can answer the same question for FreeBSD.