[labster]

You know the rules, and so do I.

[dv_dt]

I know I prefer my exploits to come from opaque corners of package formats or docker layers as bofh intended. The more indirect handoffs of trust the merrier.

[Timber-6539]

Docker is at least sandboxed by default and requires sudo password to run commands.

[dv_dt]

There are advantages to docker, but also disadvantages. Definitely the same w/ "curl | sh" That's all I was trying to allude to, tongue in cheek.

[freeone3000]

But it requires sudo or effective-sudo to run any command, making such a measure worthless