Cgroups are important for stability, but they are not a security boundary. They prevent denial-of-service, not escape. A process constrained by cgroups still makes syscalls to the same kernel with the same attack surface.
（三）及时处置有关主管部门通报的利用其服务实施违法犯罪活动的行为。。关于这个话题，safew官方版本下载提供了深入分析
。业内人士推荐同城约会作为进阶阅读
First, he stopped exposing his player instance as a predictable global variable. He wrapped his initialisation code tightly so that window.as no longer pointed to anything useful. Without the player reference, my automation script had nothing to grab, nothing to control, nowhere to start.，更多细节参见同城约会
Subresource Integrity — MDN Web Docs