If it runs inside the sandbox and the guest is compromised, can't the guest just lie?
Absolutely. That's why overlay is not the default.
alt Hacker News
Absolutely. That's why overlay is not the default.