Unverified50% confidenceFactExact time
Traditional containers (such as Docker) provide process-level isolation but share the host kernel, which can be breached once a kernel vulnerability appears.
1
Sources
50%
Confidence
Long-term
Relevance
9/13/2026
First Seen
Sources
Related Entities
Related Claims
Unverified普通Docker容器共享宿主机内核存在内核漏洞逃逸风险，而MicroVM为每个实例分配独立Linux内核78% similarUnverified容器内进程仍是宿主机上的原生进程并共享同一宿主机内核，一旦突破内核边界拿到root就能攻击其他沙箱77% similarUnverifiedDocker containers achieve process isolation through Linux namespaces and control group technology, preventing AI Agents inside the container from directly accessing the host machine's file system, network, and processes.73% similarVerified容器技术（以Docker为代表）利用Linux内核的namespace机制实现进程、网络、文件系统隔离，借助cgroups限制CPU、内存等资源用量72% similarUnverified容器技术依赖Linux内核的namespace和cgroup机制实现进程隔离，所有容器共享同一宿主内核71% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/919221API
curl https://kongchang.com/api/v1/knowledge/claims/919221MCP
get_claim(id=919221)