List the residual classes.

Day 106 - 2027-01-11 PT target - TikTok

Video caption

List the residual classes. Attribute vendor architecture. Mark escape audits untested. Substrate policy is part of readiness. Record the choice. Narration uses Eric's authorized AI voice clone. #EricFieldNotes

Full written post / accessibility read

I copy the OWASP residual class list next to my DIY container flags. Host kernel, docker.sock, writable host paths, supply chain, limits, seccomp, user namespaces. Whatever remains open stays on the risk register.

Docker describes own kernel, private daemon, no host path. I attribute that to the engineering post. An independent escape audit of a managed sandbox product stays untested until someone runs it.

Before a coding agent demo, I ask whether network, secrets, and file policy are set in the substrate. If the answer is we told the model not to, that is not substrate policy.

I want a ticket that names the substrate choice and the residual acceptance. That is how substrate stops being an invisible default.

Narration uses Eric's authorized AI voice clone.

#EricFieldNotes

Four-beat scene transcript

1. List the residual classes.

I copy the OWASP residual class list next to my DIY container flags. Host kernel, docker.sock, writable host paths, supply chain, limits, seccomp, user namespaces. Whatever remains open stays on the risk register.

Visual: Then ask what your shell still shares.

2. Compare to microVM claims carefully.

Docker describes own kernel, private daemon, no host path. I attribute that to the engineering post. An independent escape audit of a managed sandbox product stays untested until someone runs it.

Visual: Attribute vendor architecture. Mark escape audits untested.

3. Probe secrets and network before demo day.

Before a coding agent demo, I ask whether network, secrets, and file policy are set in the substrate. If the answer is we told the model not to, that is not substrate policy.

Visual: Substrate policy is part of readiness.

4. Record the choice.

I want a ticket that names the substrate choice and the residual acceptance. That is how substrate stops being an invisible default.

Visual: Substrate decision gets a ticket like model choice.