Hacker News Reader

One user with sudo for sysadmins on baremetal and a sudo access without CAP_SYSADMIN on container should be good.

I like seeing qmail as blueprint how a secure app that needs elevates permissions should be designed, in fact it has 7 users.