build1 publisher
Bubblewrap hands the PDF binary one directory and no network by default
Escaping an uploaded filename keeps it from turning into a shell command, and it still leaves the parser reading everything the worker's account can read. A dev.to write-up draws the other boundary with Linux namespaces.
Publishers:dev.to
Reality
- Evidence40
- Adoption
- Insufficient
- Hype gap−10
- Incentives55
- Confidence45