[l23k4]

Using containers as a security boundary is inexcusable.

[overfeed]

That entirely depends on one's threat-model. Also, containerization is 100x better than rawdogging.

[l23k4]

> That entirely depends on one's threat-model

I think not, virtualization has such low overhead now that there's just no excuse. It's generally trivial to switch from containers to VMs.

[koolala]

It is excusable if all you care about is blocking sudo access while letting the ai use a pseudo sudo.

[rafterydj]

Could you elaborate on this?

[l23k4]

The cost-benefit ratio of using VMs over containers is very high. You trade negligible overhead for an actual security boundary.

Containers don't provide good isolation and tend to be trivial to break out of.