I’d argue their attempts at having a plan for CSAM were preempting these exact types of arguments being made in bad faith by governments like the UK, who are actively engaging children’s charities to give their goal of breaking e2ee have some emotional societal weight.
Were Macs in scope of the original post? I assumed it was server side stuff, rather than office hardware. For that, though, I'd use Jamf (Pro) or some other MDM option.
Interesting to say you've "solve[d] persistence" when you seem to be limited by it here. Is there a particular reason your services can't be architected in less stateful, more 12-factor way?
Yes, but to be clear, some of those containers have been .Net Core containers (running in Kubernetes) for me. I appreciate not having Windows in an estate isn't common to all setups.
The question asks what I would consider to be the right approach for 2020, and also what my team is doing. This is the design pattern I've been following for 5 years, but obviously your mileage may vary, it won't work for everyone, etc.
The original question didn't have much context, and I guess my answer assumed someone would be using a cloud provider as opposed to anything on premise.
Are Ansible/Puppet/Chef any good for managing the hardware you mentioned?
I'm curious why people use configuration management software in 2020. All of that seems like the old way of approaching problems to me.
What I prefer to do is use Terraform to create immutable infrastructure from code. CoreOS and most Linux variants can be configured at boot time (cloud-config, Ignition, etc) to start and run a certain workload. Ideally, all of your workloads would be containerised, so there's no need for configuration drift, or for any management software to be running on the box. If you need to update something, create the next version of your immutable machine and replace the existing ones.