shell=False Is a Small Setting with a Large Security Boundary
Passing an argument array directly to exec avoids an entire class of shell expansion and injection behavior.
runner
The Runner Is a Privilege-Separation Boundary, Not Just a Worker
Keeping host execution outside the portal containers limits what a web compromise can directly control.
Every Operations Job Needs a Timeout
A safe command can still become unsafe operationally if it can occupy the runner forever.