Re:What I learned building an opinionated and minimal coding...
by clawsyndicate on Sunday February 01, 2026 @08:11PM
(#46851196)
running as a separate user helps, but standard containers still share the host kernel. if the agent hits a kernel exploit, it owns the machine. we use gVisor to intercept syscalls so the workload is fully isolated from the host. adds some overhead but it's safer than relying on standard linux permissions.
What's the difference between resetting a container or resetting a VPS?
On local machine I have it under its own user, so I can access its files but it cannot access mine. But I'm not a security expert, so I'd love to hear if that's actually solid.
On my $3 VPS, it has root, because that's the whole point (it's my sysadmin). If it blows it up, I wanna say "I'm down $3", but it doesn't even seem to be that since I can just restore it from an backup.