不用改容器镜像里的任何东西，就能把镜像体积压缩最多 30 倍（编译型语言更明显），同时收紧安全配置。
为容器提供用户态内核，在 Go 中实现 Linux 系统调用接口，让 Docker 和 Kubernetes 容器获得更强的安全隔离，同时保持 OCI 兼容。
一个把 QQ、Discord 等聊天平台与大模型、插件和 MCP 能力串起来的 AI Agent 开发框架，能快速搭建多平台聊天机器人和智能助手。
给 AI Agent 提供安全、快速、可扩展的沙箱运行时，基于 Kubernetes 隔离执行环境，防止智能体代码越权或污染宿主。
为 AI Agent 提供安全隔离的云端沙箱环境，内置真实工具和代码解释器，让 Agent 能安全执行代码、操作文件而不影响宿主系统。
…-qqjf-6cxw). - Addresses CVE-2026-123876, default seccomp profile socket deny rule could be bypass by a malicious container.
…first start, and browser-node runs under a custom seccomp profile. The controller and browser-node images change; the client, LangChain and MCP bridge packages change onl
… could not lock memory, as in system-probe, whose seccomp profile denies mlock . It now evaluates the XCCDF rules there. - CSPM: The Agent removes the temporary files of
…ate actions/setup-go to v7.0.0 (40ab07ee5) Handle SECCOMP RET LOG in the sentry (176f861b0) Honor DAC capabilities in mq open (3fd8e2caf) Update C++ dependencies for Baze
… hardware keyboards. - Added dialog for selecting seccomp modes. - Added Samsung device fallback support. Language Support & Formatting - Added formatter management. - Ad
…rm/microservices-demo/pull/2589 fix: nest .Values.seccompProfile.enable and .Values.securityContext.enabled correctly by @CarstenSon in https://github.com/GoogleCloudPlat