if you run a container, there is no security guarantee of any kind;
If a vulnerability is injected into the primary or secondary RouterBOOT (or vendor pre-loader), then even Netinstall may not be able to fix it.
It sounds like even using other security stuff like firewall, building and updating container in clean environment, etc. there is still a security risk that, even discovered, will remain forever (because RouterBOOT should be overwritten and there is no official clean way for it).
But, we also have Protected RouterBOOT. Will it help prevent malicious code injection into RouterBOOT when using container or it doesn't help?
It says that "what works inside container has it's own security problems" and that implies that if the "something" container got infected then ale the RouterOS' "guts" could be fully exposed to container's system unless it is configured to protect changes form LAN or shell side.
I think here: "restricting access to the bootloader", "If you forget the RouterOS admin password while Protected RouterBOOT is enabled, the device cannot be recovered without performing a complete reformat".
It's enough to have write protection on RouterBOOT to reinstall trusted system.
Shell side access couldn't be restricted, I think.
And unfortunately there are container vulnerabilities that give root access to the host system (CVE-2022-0492 for ex) so closing access to configuration channels from LAN or other sides will be bypassed.
Running containers generally opens a can of worms ... and if the platform doesn't offer tools to prevent those worms to spread uncontrollably (and if that bothers admin), then it's perhaps best to select another container platform. Or at least another device where getting it compromised doesn't compromise some core functionality as well (such as border router/firewall).
In short: I really hate the everything-in-one devices. And I'm not the only one, my better half doesn't like the combined washer/dryer machines, she prefers to use two specialized machines.
For the first... washing machines use very little water these days.
For the second... it depends where you live...
In Italy, when it's 40°C in the shade, you just take them out of the washing machine and they're already dry...
But in other climates... They won't dry out at all, if you lay them out, at most they'll get wetter...
