How We Rooted Copilot

Re:How We Rooted Copilot by j-krieger on Sunday July 27, 2025 @06:20AM (#44700225)

Every infra I ever worked in used this pattern to a degree. Many proxmox vm's in a kubernetes cluster.

[ Parent | on HN ]

Re:How We Rooted Copilot by silverliver on Sunday July 27, 2025 @06:54AM (#44700372)

I've seen people manually create a separate unprivileged user on the host for each VM they run, so for them the pattern becomes:

1. VM running on hypervisor as unprivileged host user

2. Container running in VM as unprivileged vm user

3. Payload running in container as unprivileged container user.

Not sure whether layered isolation is worth the increased attack surface. For normal users (not targets of state actors), it probably is.

[ Parent | on HN ]