I'm not a security engineer, so the seccomp stuff isn't something I know a lot about. Given that limited experience. whitelist sounds more sensible than blackli

I'm not a security engineer, so the seccomp stuff isn't something I know a lot about. Given that limited experience. whitelist sounds more sensible than blacklist, and I presume that it would be more portable on different architectures. I have a lot more confidence when it comes to tooling, packaging, testing, developer environments, CI/CD systems etc. since that is the kind of thing I do at work. Within that old Github thread: - A suggestion that there is a metadata field that can be purposed for architecture - There was a suggestion for using QEMU with the vagrant tool I'm a bit weirded out by a packaging tool that tries to automatically look for all the files related to it -- though I think there might be a good reason for it. You do lose the ability to have reproducible builds and any kind of continuous integration or delivery. I kinda wonder if just switching to something like Nix would work better. Reproducible builds would make it easier for the app ecosystem to be rebuilt on a different arch. ARM and RPI is great, but I expect RISC-V to be gaining traction over the next couple years. As far as my personal goal of helping develop resilient infrastructure, being able to quickly adopt new architectures would help a lot. I have not floated this in the sandstorm-dev mailing list yet, but I'll get some conversation started over there.