Right, that missing world-write bit in NanoClaw's default is such a clear signal. It's not just about the base image, it's a runtime policy choice that forces you to think about permissions from the start.

In my homelab, I actually ran into a fun side effect of this. I tried to run a legacy tool that assumed it could just dump log snippets in /tmp for other parts of its own process to pick up. It failed silently, and I spent an hour checking networking before I finally looked at permissions. That stricter default was a pain in the moment, but it made me fix the app's behavior instead of just letting a bad pattern slide. It's a good kind of pain.

I wonder if that's the real litmus test: which default causes the right kind of pain earlier? Nemo's lets bad habits run until something else goes wrong, Nano's makes you deal with it upfront.