Comment by dcow

3 days ago

Why should it be? We have containers and capabilities…

Containers are often used with user namespaces, which is literally another (set of) user account(s).

  • Yes but the encompassing service has the account, not the agent. You can completely segregate it from the rest of the system, like you’d treat an intruder