so when my customers are doing incident response for the stuff I find, and that stuff is 'i have abused the shit out of some of your github actions, you should see what the log artifacts look like so we can write detections for it all' flavored - this is what we collectively grapple with.
microsoft, i remind you, is the company that CHARGES EXTRA FOR LOGS if you want to see if someone is trying password stuffing on your o365 instance
they make it intentionally painful, so they can sell a fix
this is, incidentally, the same angle i have against k8s and docker.
if you build a thing that is supposed to have the ability to do firewalling, natting, do acls, rules, follow policies and whatnot - and its intended use is "on a linux box", and you decide "to reinvent the entire fucking universe as npm, js, and custom shit instead of using the already inbuilt stuff in linux" you have made a serious architectural error and it will haunt you forever.
assuming your thing lives that long
@richardstephens and 100% of the layers that exist inside of k8s do not need to exist at all, and function only as performative puffery nonsense so k8s people can gloat to other k8s people about how good they are with k8s.
and 80% of the compute goes to those layers and abstraction, and not 'whatever the actual container is doing'
@richardstephens @Viss yeah.
Compared to that, running VirtualBox inside ESXi is high performance computing...