We are long time virtualmin users and are currently evalulating cloudmin to be used as backend for our virtualization needs. I found most probably cloudmin is just loop mounting guest images on host and doing its stuff. We feel this may cause insecurity in case of bring your own images (means third party provided non-trusted images) being imported into cloudmin and run.
Please refer to (A reminder why you should never mount guest disk images on the host OS)
The post rightfully suggests using libguestfs as method for guest disk image manipulation/mounting.
libguestfs internally spawns a dedicated/temp vm for mounting guest disk image.
Do you think this is real issue and can cause security vulnerability? Are you actually using libguestfs or similar mechanism?
A clarification or update is highly appreciated. This will give us confidence to go ahead with production use of cloudmin.