rerere is a lifesaver here.

(I’m also a fan of rebasing; but I also like to land commits that perform a logical and separable chunk of work, because I like history to have decent narrative flow.)

Not everything, but this is.

Yes. The sandbox gets whatever capabilities you expose to it.

I had a small X.25 network as combination coffee-table and space-heater at one point; this was before most homes had internet. It almost cost me a divorce.

Doesn’t need to be a “traditional” container. Modulo noisy-neighbour issues, wasm sandboxing could potentially offer an order of magnitude better density (depending on what you’re running; this might be more suited to specific tasks than providing a substrate for a general-purpose conpute service).

That’s not correct, but it shouldn’t preclude you from applying defence in depth.