Customer plugins run in the customer's box, not yours

Your SaaS lets customers upload plugins. Customer 41 uploads one that shells out, reads /etc/passwd, scans the subnet, and tries to read another tenant's uploads.

It reads its own /etc/passwd. Each customer's plugin host is a container with its own root filesystem. It scans a /30 subnet with one machine on it: every container sits on its own Linux bridge, no shared segment. It lists processes and sees only its own; PID namespaces hide the rest. The other tenants' uploads are on filesystems it cannot mount, name, or know about.

A malicious plugin owns one computer, and that computer belongs to the customer who uploaded it. You delete the container, restore customer 41 from last night's snapshot, and send them an email.

No plugin sandbox to write, no syscall allowlist to maintain. The plugin boundary is the container boundary.