I disagree on the containerization part. It can absolutely improve security a lot by facilitating isolation of namespaces and filesystems. But perhaps base con

I disagree on the containerization part. It can absolutely improve security a lot by facilitating isolation of namespaces and filesystems. But perhaps base container images on scratch, not on ubuntu:latest ;)