They are down to nine system calls, perhaps they can "pledge" the rest away after the container bootstraps? I am thinking of what OpenBSD has been designing: h

They are down to nine system calls, perhaps they can "pledge" the rest away after the container bootstraps? I am thinking of what OpenBSD has been designing: https://man.openbsd.org/pledge.2 https://man.openbsd.org/pledge.2