Фото: Yves Herman / Reuters
If you enable --privileged just to get CAP_SYS_ADMIN for nested process isolation, you have added one layer (nested process visibility) while removing several others (seccomp, all capability restrictions, device isolation). The net effect is arguably weaker isolation than a standard unprivileged container. This is a real trade-off that shows up in production. The ideal solutions are either to grant only the specific capability needed instead of all of them, or to use a different isolation approach entirely that does not require host-level privileges.
，这一点在51吃瓜中也有详细论述
The first version of my extension was built on a simple observation: HotAudio’s player was exposing its active audio instance as a global variable. You could just type window.as into the browser console and there it was; The entire audio source object, sitting in the open like a wallet left on a park bench.
Continue reading...
Notably, the round remains open, and OpenAI expects more investors to join as it proceeds.