Canonical Switches Ubuntu 25.10 to Sudo-Rs as the Default Sudo

Was there any discussion about why they didn't just go with run0? Since systemd-run and run0 are already present, it doesn't expand the attack surface, and removing sudo entirely would reduce it.

I know that it has some differences, such as that privilege escalation from within containers works differently. But, it is also considered a more secure solution than sudo.

Making systemd (and the suite of software around it) memory-safe seems like a better goal.

I suppose the real answer is that a drop-in memory-safe replacement for an existing package is potentially an incremental improvement.

But, a heavily peer-reviewed and battle-tested package like sudo is also less likely to have bugs than a rewrite.

Did they use formal verification or any other approaches to provide guarantees?