Systemd, vsock, & openssh-server
TL;DR – With systemd v256+, installing openssh-server on a VM automatically creates a socket activated SSH listener on af_vsock:22 in the global network namespace. This breaks the usual namespace isolation and opens a hidden, low‑visibility channel that malicious code can use to hop from containers or sandboxes straight to the host. It also brings attention to [ ]