Security quotes of the week

Not quite. Ironic provisions an entire operating system, including kernel - all hardware access is mediated by code under the user's control. LXD allows you to deploy entire userlands, but not the kernel. The argument is that Ironic is dangerous since a malicious user can use direct hardware access to modify components of system firmware such that later users of the same hardware can have their sessions compromised. LXD avoids this by ensuring that there's a trusted kernel blocking any attempts to hack the firmware.