On the XZ back door thread multiple people are shitting on systemd I, but I think its sandboxing model is easier because you just couple the expected behavior

On the XZ back door thread multiple people are shitting on systemd I, but I think its sandboxing model is easier because you just couple the expected behavior of your application along with the unit. Interested people should look here[1] and [2] in case you need resource limitations, like limiting the amount of CPU a process can use. Of course, there is no way to isolate a backdoored piece of code running in the same address space as yours. [1] https://www.freedesktop.org/software/systemd/man/latest/systemd.exec.html https://www.freedesktop.org/software/systemd/man/latest/syst... [2] https://www.freedesktop.org/software/systemd/man/latest/systemd.resource-control.html https://www.freedesktop.org/software/systemd/man/latest/syst...