> Capability-based OSs wind up being significantly slower and very irritating to use. > For example, look at all the pissing and moaning about SELinux. SELinu

> Capability-based OSs wind up being significantly slower and very irritating to use. > For example, look at all the pissing and moaning about SELinux. SELinux is not a “Capability-based OS.” It’s giant step in a direction that is pretty much opposite to capabilities. Seriously, try basically anything on Linux that tries to delegate one’s authority to something less privileged (e.g. basically any container runtime). Bind-mount something in, and then watch the kernel grumble about SELinux failures originating inside the container, where the runtime would have appropriate permission but the container processes are labeled differently and don’t. This happens because SELinux is not capabilities; it’s a very complicated and difficult to configure MAC system, which is pretty much at the opposite end of the spectrum. Podman and friends have IMO horrible workarounds built in.