Hacker News new | past | comments | ask | show | jobs | submit
Rootless namespaces are getting better, but they don't eliminate the host kernel attack surface