RFC

[rugged hill]

@blazing mortar , agreed , but we could build real isolation through credential separation across containers, cap_drop: ALL , no-new-privileges, non root user etc., read only root, no host mounts to sensitive paths