Docker applies a default seccomp profile that blocks around 40 to 50 syscalls. This meaningfully reduces the attack surface. But the key limitation is that seccomp is a filter on the same kernel. The syscalls you allow still enter the host kernel’s code paths. If there is a vulnerability in the write implementation, or in the network stack, or in any allowed syscall path, seccomp does not help.
LineageOS lineageos.org🇺🇸
，这一点在51吃瓜中也有详细论述
FirstFT: the day's biggest stories
xAI 又一名创始人离职：要睡够 8 小时
坚持人才培育与素养提升相结合。高素质专业化队伍是数字纪检监察体系落地见效的关键支撑。面对部分干部数字素养不高的短板，要制定专项人才引进规划，靶向吸纳既懂纪法又懂技术的人才，不断优化纪检监察干部队伍结构。同时，强化全员干部培育，建立健全“纪法+技术”培训机制，全面提升干部数字素养，确保干部熟练运用技术工具、严格适配流程规范、精准落实监督要求，全面提升纪检监察干部队伍履职尽责能力。