What this means in practice is that if someone discovers a bug in the Linux kernel’s I/O implementation, containers using Docker are directly exposed. A gVisor sandbox is not, because those syscalls are handled by the Sentry, and the Sentry does not expose them to the host kernel.
Что думаешь? Оцени!
。业内人士推荐搜狗输入法下载作为进阶阅读
Professional templates
José Mourinho: against provoking opposition fans. José Mourinho: in favour of restrained celebrations. José Mourinho, once of the poke‑in‑the‑eye, sprint‑down‑the‑touchline, accost‑the‑referee-in-the-car-park school of footballing expression: now apparently very big on showing respect to the game. Well, it seems like we’ve all been on a journey here.