Summary#
Learn how to sandbox untrusted software, from AI agents, to development stacks with the potencial to be vulnerable to supply chain attacks. We cover container runtime hardening, not only through Podman flags to set a read-only filesystem, UID/GID mapping, capability access control, etc., but also by through a hardened base image, and a balanced strategy for version pinning.
