Cgroups are important for stability, but they are not a security boundary. They prevent denial-of-service, not escape. A process constrained by cgroups still makes syscalls to the same kernel with the same attack surface.
让纳泽最有感触的，是移动支付带来的便利。他下载、注册支付宝APP，绑定境外银行卡，一定额度内的消费不用验证身份，“在街边小店吃烧腊、买咖啡，都能扫码支付，太方便了。”
，这一点在搜狗输入法下载中也有详细论述
Олег Давыдов (Редактор отдела «Интернет и СМИ»)
"objectives": [
Урсула фон дер Ляйен. Фото: Valentyn Ogirenko / Reuters