Embed Notice

another good reason to Just Use Systemd instead of containers is all the hardening knobs that are readily available. You can block entire slices of the filesystem that your service shouldn't access. You can block all network access except what your program needs. You can block whole entire categories of syscalls and kernel features your program shouldn't use.

It is literally just a few lines of config to do all that and it might just save you from getting popped and running a cryptominer or worse next time a dependency you didn't know about of some random app you've deployed has some disastrous RCE