It's mostly the subgid subuid mapping of ids between guest and host which is non trivial to understand in rootless envs. Add selinux in the mix....
32 karma · joined August 19, 2018
"PebbleOS took dozens of engineers working over 4 years to build..."
The original is not paywalled for me!?
I'll include a link to our datasheet [1] as to actually answer the question hoping Im not breaking HN rules.