Yep, that's what I hope everyone will be doing... thinking about their own backups and infrastructure. We have backups off-site on disconnected media, so that

Yep, that's what I hope everyone will be doing... thinking about their own backups and infrastructure. We have backups off-site on disconnected media, so that alone prevents the kind of accident we're talking about. We use btrfs send / receive to send OS images from the primary container host to the backup container host. The snapshots are read-only, so I'm fairly sure I can't just 'rm -rf' them, I'd have to actually 'btrfs subvolume delete foobar' them. I should try that though on one of the test servers...