Post #2614405

@danb I enjoyed your OpenCode sandboxing post! One tweak that adds a good amount of security for not much cost is using rootless podman (drop in replacement for docker). You can prevent the container from accessing your local network and also drop OS privileges you don't need with a couple extra flags