interesting approach. how does the cost scale for persistent tunnels? durable objects bill by active duration and memory, so this seems expensive compared to a standard ingress controller. curious if you hit any connection limits per object.
since we allow agents to execute arbitrary python, we treat every container as hostile. we've definitely seen logs of agents trying to crawl /proc or hit the k8s metadata api. gvisor intercepts those syscalls so they never actually reach the host kernel.