> If you can run software on the host there will always be a way to compromise the host. It is not even 100% safe to run software in a vm because exploits have

> If you can run software on the host there will always be a way to compromise the host. It is not even 100% safe to run software in a vm because exploits have been found to break out. That's... inaccurate. More valid statements would be: - In a sufficiently complex OS, it is unlikely you will be perfectly safe running untrusted executables even with reduced permissions. - Popular modern OS desktop distributions are very complex out of the box. - Sandboxing prevents certain classes of attacks effectively, but should not be relied upon as a sole line of defense. - Vulnerabilities have been found in VMs and containers, but they afford greater protection and isolation than running a process directly on a host system. IOW, don't go No-True-Scotsman on security. A vulnerability does not invalidate all benefits of an architecture.