Maybe I’m being stupid but a trivial way to ensure this is just don’t connect it to the Internet in any way. No SIM card. Cut it off from the Internet after setup, and only connect to a LAN with your chosen services all physically isolated from any internet machines.

I’ve never signed my name. I just scribble randomly in the space.

Ah, didn’t see that in my client!

This article is over ten years old. Why share it now?

Not complaining. I just don’t understand the context here.

Docker performs some syscall filtering as well which may reduce the kernel attack surface. It can be pain to set up services this way, but it could help frustrate an attacker moving laterally in the system.

Processes in the container cannot see external processes for example as I think interested the OP.

I don’t know if I’m mentally strong enough to be a paraplegic.

Let’s do politicians next.

Thank goodness that’s on .world and not on that Lemmy NSFW instance.