Landlock
The unprivileged kernel sandbox behind the filesystem boundary and the port rules, and the versions its rights arrived in.
Seccomp
The syscall filter behind the connect guard, the process-group lock and the report-only supervisor, and the ways Phobos uses it.
HAProxy
The two roles HAProxy plays: the egress broker that enforces a host name, and the inbound filter that admits a source.
timeout and the process-group lock
GNU timeout, the process group it signals, and the seccomp filter that stops anything leaving that group.
rlimits
The per-process resource limits Phobos sets, their units, and what they are not.