�@�܂�X�̍����ł́A�i�ׂ̋��c�����Ǝv�������摜�����e�B�����ɂ����Ɓu���w�ك}���K�����ҏW���̐��c�������āALINE�O���[�v�ł��̕����̘a�����������c�����B���c�͌����؏��̍쐬�����Ă��w�퍐�͌����ɑ��āA�؏��쐬��1�c�Ɠ��ȓ��Ɏ��k��150���~���x�������Ɓx�w�퍐�̖����A�ڂ��ĊJ���邱�Ƃɂ��āA�������͂��̒��~�v�����P�邱�Ɓx�Ȃǂ̓��e�ɂ܂Ƃ߂��v�Ƃ����B
先理解原理：看动图 + 手动模拟小数组
，详情可参考Safew下载
Catherine SnowdonHealth reporter。关于这个话题，同城约会提供了深入分析
Docker applies a default seccomp profile that blocks around 40 to 50 syscalls. This meaningfully reduces the attack surface. But the key limitation is that seccomp is a filter on the same kernel. The syscalls you allow still enter the host kernel’s code paths. If there is a vulnerability in the write implementation, or in the network stack, or in any allowed syscall path, seccomp does not help.