Mission 4 · Build the boundaries
One island per friend
Keep one friend’s trouble from spreading to another.
Reza and Sina will both use a bot. You are arranging their homes and connections. Convenience is tempting, but you want separate failure zones.
Sina
“If Reza’s bot gets taken over, can it get to my conversations?”
The decision
Choose the layout that best contains a compromise.
- One shared bot process and one shared folder
Put each friend’s name on a different chat. - Two profile folders on an otherwise shared system
Different folder names should be the whole boundary. - Separate isolated instances, networks, and proxies
Each friend has their own environment and restricted routes.
Reveal the explanation
Separate islands limit the paths between friends. Labels and profile folders alone do not stop a compromised process from reaching the operating system.
Separate environments are the boundary; separate names are not.- Incus creates isolated environments. Unprivileged containers use restricted identities on the host.
- Containers still share a kernel. When available and correctly configured, virtual machines add a separate kernel and a hardware virtualization boundary.
- The guide also separates each friend’s bridge and proxy rather than treating a shared network as safe.
Isolation
A technical boundary that restricts what one environment can access in another.