One SQLite file per customer

Acme signs up. A new container starts. Inside it, /hoody/databases/acme.db is created with the schema. From now on, every query Acme makes hits a database that no other tenant can see, share, or accidentally collide with.

There's no WHERE tenant_id = ? filter in any query. There's no row-level security policy to debug. There's no tenant-leak bug waiting to ship. Acme's database is a 200 KB file. Beta Corp's is 1.4 MB. Megacorp's is 6 GB. Each one lives in its own container, on the same metal, costing pennies while idle.

When Acme leaves, you rm acme.db. When Acme wants their data, you upload the file. When Acme needs a clone of their prod for testing, you cp.

Multi-tenancy isn't a row in a tenant_id column. It's a file in a folder.