不用改容器镜像里的任何东西，就能把镜像体积压缩最多 30 倍（编译型语言更明显），同时收紧安全配置。
给编码 Agent 用的轻量沙箱，不依赖容器就能限制命令的网络和文件系统访问，基于 bubblewrap、Landlock、seccomp 等机制实现隔离。
…first start, and browser-node runs under a custom seccomp profile. The controller and browser-node images change; the client, LangChain and MCP bridge packages change onl
… could not lock memory, as in system-probe, whose seccomp profile denies mlock . It now evaluates the XCCDF rules there. - CSPM: The Agent removes the temporary files of
…ate actions/setup-go to v7.0.0 (40ab07ee5) Handle SECCOMP RET LOG in the sentry (176f861b0) Honor DAC capabilities in mq open (3fd8e2caf) Update C++ dependencies for Baze
… hardware keyboards. - Added dialog for selecting seccomp modes. - Added Samsung device fallback support. Language Support & Formatting - Added formatter management. - Ad
… hardware keyboards. - Added dialog for selecting seccomp modes. - Added Samsung device fallback support. Language Support & Formatting - Added formatter management. - Ad
…rm/microservices-demo/pull/2589 fix: nest .Values.seccompProfile.enable and .Values.securityContext.enabled correctly by @CarstenSon in https://github.com/GoogleCloudPlat