[kylecodes]

"the build container now has a privileged sidecar that does all of the signing, uploading and everything else instead of the main container with user code having that logic."

Does this info about the fix seem alarming to anyone else? It's not a full description, so maybe some important details are left out? My understanding is that containers are generally not considered a secure enough boundary. Companies such as AWS use micro VMs (Firecracker) for secure multi tenant container workloads.