You may be interested in my Python-on-ZeroVM-On-Docker Dockerfile[1]. This adds the security and isolation of ZeroVM on top of the connivence of Docker.
Note that ZeroVM isn't an x86 VM, so you need a custom Python (which that Dockerfile downloads). There are also no network sockets, so some things are difficult to make work, but you can work around that by using network code in the Docker container, and riskier code in ZeroVM.
I'd be pretty confident in that security model.
However, it's six months old now, and likely to need some updating. ZeroVM was changing pretty quickly when I was working on it.
Comments
You may be interested in my Python-on-ZeroVM-On-Docker Dockerfile[1]. This adds the security and isolation of ZeroVM on top of the connivence of Docker.
Note that ZeroVM isn't an x86 VM, so you need a custom Python (which that Dockerfile downloads). There are also no network sockets, so some things are difficult to make work, but you can work around that by using network code in the Docker container, and riskier code in ZeroVM.
I'd be pretty confident in that security model.
However, it's six months old now, and likely to need some updating. ZeroVM was changing pretty quickly when I was working on it.
[1] https://github.com/nlothian/Acuitra/tree/master/infrastructu...