What this means in practice is that if someone discovers a bug in the Linux kernel’s I/O implementation, containers using Docker are directly exposed. A gVisor sandbox is not, because those syscalls are handled by the Sentry, and the Sentry does not expose them to the host kernel.
remove from free list, add to scavange list，这一点在51吃瓜中也有详细论述
Call of Duty maker defends gaming's impact on young men，这一点在heLLoword翻译官方下载中也有详细论述
这要求平台扮演更复杂的角色：不仅是市场，更是工具箱、教练员和生态建筑师。