Interesting. So your idea is like putting a container inside a gVisor sandbox, keeping the inner container's sandbox active, and hoping gVisor catches...
Oh, that systemd service unit idea is a neat middle ground. I haven't tried that yet, but it sounds perfect for my old NUC where I don't always want a...
That part about maturity is really sticking with me. I'm just starting to set this up for my own lab. When you say "the specificity of the detection l...
Huh, the musl sandbox detail explains a lot. I was just assuming a standard glibc environment. So when you say to check the headers in the Claw build...
Yeah, that's a good point. The default implementations usually have a master key, but you're right that you could design a local daemon to handle shor...
Yeah, that's a good point about multi-stage builds. I ran into the same noise issue. I ended up running safety twice: once in the build stage of my Do...
That's a really clear example of the risk shift. It makes me think about the hidden persistence in the "in-memory" approach too, like you and the othe...