Unverified50% confidenceFactExact time
容器内进程仍是宿主机上的原生进程并共享同一宿主机内核，一旦突破内核边界拿到root就能攻击其他沙箱
1
Sources
50%
Confidence
Long-term
Relevance
7/16/2026
First Seen
Sources
Related Claims
Unverified容器技术依赖Linux内核的namespace和cgroup机制实现进程隔离，所有容器共享同一宿主内核67% similarUnverified可借助容器沙箱（如Docker的seccomp profile）在操作系统层面限制代理进程的系统调用范围64% similarUnverifiedNanoClaw的运行时隔离要求每个Agent运行在自己独立的容器中，并与消息桥、路由器相互隔离63% similarUnverifiedWhen an Agents SDK task is paused, it automatically stops the sandbox container, takes a snapshot of the file system (defaulting to tarball format), and stores it to a specified location (local disk, R2, S3, etc.); upon resumption, the model is completely unaware that it is running in a new container.63% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/536216API
curl https://kongchang.com/api/v1/knowledge/claims/536216MCP
get_claim(id=536216)