Comment by yjftsjthsd-h

> We recommend exploring ways to automate upgrading your kernel

Like, running emerge -u @world on a regular basis, or ...

/me searches

Okay, so https://wiki.gentoo.org/wiki/Live_patching exists but says,

> A note of caution: Kernel live patching is risky. Count on hard freezing or panics to become normal...

That's not encouraging.

---

Another approach: Can we make the kernel vulns less important? Has anyone had luck moving more things to run under gvisor or firecracker or such?