> the assumption is an attacker can break into the main app only? Yeah, the idea is that the main app is more vulnerable (both due to being more exposed, and a

> the assumption is an attacker can break into the main app only? Yeah, the idea is that the main app is more vulnerable (both due to being more exposed, and also because it's often more complex), hence it should have very limited permissions into the internal infra. This approach is also used in other situations, like browsers, where the process that processes website content is very locked down, and can only perform actions in the system (network, filesystem, etc) through a limited channel to an outside process.