On: Show HN: Nucleus – A security-hardened, Nix-native container runtime

[yjftsjthsd-h]

> rootfs attestation verifies a per-file SHA-256 manifest at startup;

What threat model does this protect against? Certainly nice, especially for free, but wondering about utility.

[0kenx → yjftsjthsd-h]

it's a simple integrity check for catching deployment drift/tampering.