안녕하세요. 변영욱 기자입니다.
The critical thing to understand is namespaces are visibility walls, not security boundaries. They prevent a process from seeing things outside its namespace. They do not prevent a process from exploiting the kernel that implements the namespace. The process still makes syscalls to the same host kernel. If there is a bug in the kernel’s handling of any syscall, the namespace boundary does not help.
。关于这个话题，爱思助手下载最新版本提供了深入分析
（七）提供应用程序分发服务的，应当采取监测发现、防范、阻断、处置专门用于侵入、非法控制计算机信息系统的程序、工具，未经许可、备案或者非法处理个人信息等违法违规应用程序的措施；
优点： 输出均值更接近 0，梯度更稳定。