
It'd be better to do the update as an unprivileged user; for now, we do our best to minimize the surface available. We filter mount syscalls to prevent the process from undoing the fs isolation.
It'd be better to do the update as an unprivileged user; for now, we do our best to minimize the surface available. We filter mount syscalls to prevent the process from undoing the fs isolation.