[chrisweekly]

Or put it in a microvm using eg smolmachines.

[causal]

I've never used smolmachines but I'm curious; why this over a container?

[apitman]

Containers are not security boundaries. Vulnerabilities in containers are much more common than in VMs.

[chrisweekly]

Kernel-level isolation is a significant security differentiator, for starters.

https://github.com/smol-machines/smolvm#comparison

shows a good comparison table.

[bionade24]

Using runsc instead of runsc means that there's a hypervisor layer (gvisor, probably) in-between the kernel and the container userland