Diacone Frost on Nostr: well, kernel issues put aside, processes in container do run a in a different cgroup, ...

well, kernel issues put aside, processes in container do run a in a different cgroup, that's huge thing in terms of separation on it's own and eliminate a lot of security risks alone.

with good selinux policices and permissions you can achieve solid security.

problem is that people usually want complete opossite. They want containers (and flatpaks and other things) to access their space, so they deliberately share disks, networks and sockets (like dbus) and what not.

And they think that it keeps the same security properties...