zlacker

thus "sacrificial toy boxes"

also, your faith in "VM" insulation appaears greater than mine. if i dont trust a VM i dont trust the host running the VM.

others have different opinions and that's ok. my systems run to my standards, however quirky they may be. im stating opinion here, not attempting to inscribe Sysadmin Commandments. them's written on the wall of the bathroom stall.

edit: just for reference, the last cpu i could say i trusted was before speculative execution was a feature. since then its more about risk mitigation. i'm not paranoid, there's people worse than me, and they're nuts. I'm just cautious and lazy.

>>h2odra+(OP)
If you don’t trust your hypervisor, buy a pi or cheap nuc, but also your hypervisor being 0day’d is probably far less likely than one of the thousands of apps in $PATH being compromised or malicious.

>>h2odra+(OP)
I understand not fully trusting docker, you have to trust several levels of kernel features and configuration, plus it shits all over your firewall like it owns the place.

Real virtualization is a bit more airtight, though. There have been some escape exploits but they all abused drivers that you wouldn't use heedless (shared folders, VGA, PCIe passthrough), not the virtualization layer. But that's a distinction without a different, really, so good on you for being careful!

>>h2odra+(OP)
Home assistant isn't malware, it's a major open source project that is well understood.

This isn't some binary you downloaded from a Russian forum. VM isolation is more than enough.

>>wkat42+X4
If it's so trustworthy, why do you even need a VM?

>>JohnFe+1r1
Because it is a long running process, and it has plugins. Amd because both the container and the VM are premade, you don't even have to install, you just run them.

You can extend the container image with your own Dockerfile.