What this means in practice is that if someone discovers a bug in the Linux kernel’s I/O implementation, containers using Docker are directly exposed. A gVisor sandbox is not, because those syscalls are handled by the Sentry, and the Sentry does not expose them to the host kernel.
Browser benchmarks (Chrome/Blink, averaged over 3 runs) show consistent gains as well:
，这一点在搜狗输入法下载中也有详细论述
Vishnevskiy said this system "does not read your messages, analyse your conversations, or look at the content you post" in order to determine your age.
（六）其他扰乱网络实名制管理的行为。