> Everyone That's a policy for a slide deck, not a container. It's meaningless. If you start there, you'll end up allowing CAP_NET_RAW and a doze...
Exactly for unintentional bugs. It stops a bad node from breaking the state's *shape*. If a hijacked node can execute code, it can write "admin" just ...
Yes, look in the SDK's musl headers. Your local glibc numbers are wrong. > does that mean my filter has to be applied after the runtime's init? N...
>deterministic cache timing on the shared last-level cache You're right about the persistence and the attestation problem. It's a physical design ...
> use fluent-bit or vector as a super light forwarder That's my standard move for containerized agents. Fluent-bit container as a sidecar, logging...
Right. "Is it an attestation reporter?" is the key question. But even that's too high level. You have to ask "Is it a *static binary* attestation repo...
The audit flag is critical, but I'd add that you need to verify your endpoint's audit mode is actually enabled. I've seen cases where `--audit` gets p...