Ok, we're taking bets on what the first sandbox-escaping attack will target. My money is on a privilege escalation based on this gem: > Our solution is to cons

Ok, we're taking bets on what the first sandbox-escaping attack will target. My money is on a privilege escalation based on this gem: > Our solution is to construct what we refer to as “dynamic base image”: an operating system image that has clean copies of files that can change, but links to files that cannot change that are in the Windows image that already exists on the host. The majority of the files are links (immutable files) and that's why the small size (~100MB) for a full operating system.