Compartmentalization, "am I doing it right?"

[fsflover]

See also:

What Threats do Minimal Templates Protect Against?

It’s not clear to me what threats minimizing the installed software and attack surface in this way protects against. Even if other apps in the VM have unpatched vulnerabilities, I don’t see attackers going after other user-space applications. Having a lot of templates takes up a lot of space and maintenance time, so it’s something I try to avoid. The majority of my AppVMs are based on the current Fedora template, which has all the software they all need. I have made several templates based on t…