@HSVSphere most devs have no idea what containers do with cgroups, namespaces and syscalls, but I don't blame them. most learning resources for docker and company are horrifically vague

@squandered_pie most people do not even need half the stuff docker does. docker doesn't even do these things properly and breaks all the time its network stack, for example

@HSVSphere @squandered_pie network abstractions on docker are really nice for testing tho

@HSVSphere @squandered_pie Most people would do well with different users for different packages (just put everything in the <appname> home folder) and iptables rules to remap the userland ports where they want them. You get per-app isolation by default, and you don't need any privilege escalation.