Maybe this is obvious but TIL a bwrap read-only mount does *not* stop you from opening and writing to sockets, including, say, incus and docker control sockets