This strikes me as a terrible hack. Yes, I've run into all of the problems this is trying to solve, but if this is what is necessary to fix them, I rather build my packages from source (or use *BSD and ports/pkgsrc).
There are potentially cleaner approaches, but they require immensely more manpower than I could seriously consider mustering. There are options such as writing and upstreaming new system calls to implement some sort of union-filesystem/chroot() mix, which, based on past attempts to upstream a union filesystem into the kernel, won't happen. Other approach is to altering/packaging every single package I am interested in - including proprietary software - so that they play nicely together. Nix/NixOS is making an admirable attempt here, but they don't have the manpower to package enough things. For now, Nix is, sadly, academic.
Personally, I find that while it isn't the simplest system from a high-level design point of view, Bedrock Linux's approach is by far the most practical solution to the problem I aimed to remedy. And it works, and I'm running it now. It is certainly not for everyone or for every use case. I made it for my own uses, which it serves admirably. Enough people seemed interested that I made it available publicly. You're welcome to continue using whatever software stack you prefer - I don't intend to snag everyone. Or even very many people. I'm happy to be the only one using it. However, I do aim to share if there are others out there interested in it.
Fat kernel = huge attack surface.
Funky chroot / path stuff = source of bugs.
Multiple distro-specific APIs = n x sync latencies, n x diskspace, n x attack surface
Size of user community = 1 / n x 0.1337 (contingencies' constant)
Oddly enough, the vast majority of Bedrock Linux users, from what I can tell, are ex-Gentoo people. If you've come to the understanding that building everything from source is a viable alternative to what Bedrock Linux is trying to do, you've misunderstood (which could be my fault for not being sufficiently clear). One of the things Bedrock Linux provides is a way to build your system with Gentoo's portage, but still have the option to get something else now from some other distro if you don't have the time or patience to compile it with portage.
> Fat kernel = huge attack surface. Funky chroot / path stuff = source of bugs. Multiple distro-specific APIs = n x sync latencies, n x diskspace, n x attack surface. Size of user community = 1 / n x 0.1337 (contingencies' constant)
This is addressed here:
http://bedrocklinux.org/faq.html#why_not_use_bedrock
Basically, yes, you're correct. If you value such things very highly, Bedrock Linux isn't the distro for you. Maybe hardened Gentoo or Qubes OS would be better suited.