ML is pretty promiscuous (as are some other ecosystems), so supply-chain is a realistic threat to a developer. restricting the user that runs such code is help

ML is pretty promiscuous (as are some other ecosystems), so supply-chain is a realistic threat to a developer. restricting the user that runs such code is helpful. but suppose it gets owned: - can it call home? - can it escalate to root? the latter might be via a local kernel compromise, but that's challenging if calling home is hard. otoh, sudo is often installed...