You can do rollbacks if you’re using something like home-manager on a foreign distribution. It’s just a bit more janky admittedly.

There’s a transaction fee, the higher you pay the more priority you have (since miners get a cut).

Not in this one, iirc they actually reverse engineered and were working off of apple libraries, rather than proxies.

As a Linux user (and ex arch user btw), I’m deeply offended.

The point is to minimize privilege to the least possible - not to make it impossible to create higher privileged containers. If a container doesn’t need to get direct raw hardware access, manage low ports on the host network, etc. then why should I give it root and let it be able to do those things? Mapping it to a user, controlling what resources it has access to, and restricting it’s capabilities means that in the event that my container gets compromised, my entire host isn’t necessarily screwed.

We’re not saying “sudo shouldn’t be able to run as root” but that “by default things shouldn’t be run with sudo - and you need a compelling reason to swap over when you do”