20One container panics the host kernel and takes down forty neighbours. Where is the real isolation boundary, and what do you tighten first?▼hardNewCloudflareNVIDIADatabricks○ sign inNamespaces partition resources, not trust. This question finds the people who know which sysctls are namespaced, which ones change every tenant at once, and when only a second kernel will do.Open full answer →
45Preview environments are easy until the first one needs a database and a payment provider. How do you handle that?▼hardNewGitLabAtlassianStripe2 replies◆ premiumDeploying the application per pull request is a solved problem. Giving it data it can work against, and dependencies it can call, is where these projects stall and where the data-protection incident lives.Open full answer →
32Containers share the host kernel. Which escape routes worry you most, and what reduces the risk?▼mediumNewRed HatNetflixCloudflare◆ premiumEscapes ride kernel bugs, privileged configuration and host mounts, not namespace magic. Cut the syscall and capability surface first, sandbox only what the trust boundary demands, and build nodes expecting compromise.Open full answer →
38A model's output feeds a shell command, a SQL query and a web page. What is your threat model?▼expertNewCloudflareGitHubMicrosoft2 replies◆ premiumModel output is attacker-influenced data by construction, because the model reads attacker-influenced input. Every rule you already apply to user input applies here, and teams forget because the text came from a system they built.Open full answer →
