Instead of filtering syscalls to the host kernel, gVisor interposes a completely separate kernel implementation called the Sentry between the untrusted code and the host. The Sentry does not access the host filesystem directly; instead, a separate process called the Gofer handles file operations on the Sentry’s behalf, communicating over a restricted protocol. This means even the Sentry’s own file access is mediated.
'Irresponsible and offensive'
，详情可参考51吃瓜
But he told the BBC: "Where practices are struggling and falling short we're not going in there to beat people over the heads, we're going in there to support and to share excellent practice from those who are doing really well with same-day urgent access, making sure that we roll that out."
AI的进化之路还远远看不到终点，甚至有没有终点都要打个问号。