Yeah, I think I got it wrong, I thought about /usr, but it can be setup on a separate FS as well.

I believe that the only FS that absolutely need to be on the root partition are /etc and /var. The rest can be anywhere else with various degrees of tinkering. For /home to be moved, you should just need to edit your fstab (or your systemd mounts, depending on your distro).

I really love all the 5+ years old articles about why systemd sucks.
It’s not perfect but it’s so much better than the plethora of different init methods Linux used to have. Also managing sysv init scripts sucked really bad.
It’s lightweight, most of it is optional, it’s declarative, it makes managing your systems much easier and it just works.

To provision VMs yes, to configure them I think Ansible works best. But you can call Ansible from Terraform.

It’s probably both

You can use udev rules and systemd mount or AutoFs.

https://wiki.archlinux.org/title/Udev
https://wiki.archlinux.org/title/Systemd#systemd.mount_-_mounting

https://wiki.archlinux.org/title/Autofs

It was definitely a headache for me as well, but you need a guest agent (like vmwaretools or qemu-guest-agent), a cloud init ready template for the distro of your choice, a cloud init config file (network/user/vendor) and a custom SCSI/ide cloudinit cdrom mounted at boot on your VM. You also can find cloudinit logs on your VM to try and figure out what’s missing or what went wrong.

Oh shit, I was miserable back when I installed Arch. Dang, you might be onto something there!

That’s strange, apart from installing it, Arch is pretty painless to run if you’re not careless

Well it’s a good step in the right direction, not a massive difference but still

You can read about SELinux here or ACLs here. SELinux can be pretty complex if you’ve never used it, so make sure you understand it well. I believe it should be able to do what you want to achieve.

I guess you can use ACLs depending on your filesystem, or SELinux user contexts.

Maybe it’s badly implemented where I work, but I feel it’s clunky and messy

He’s not wrong but he sounds like a jackass. A minimal version sounds better than removing features that are present and used by people.

There are two types of backdoors, the ones that were fixed and the ones we don’t know about.