Unverified50% confidenceFactExact time
Containers rely on namespaces and cgroups for logical isolation and still share the host kernel; once a privilege escalation vulnerability appears in the kernel, an attacker may cross container boundaries.
1
Sources
50%
Confidence
Long-term
Relevance
10/23/2026
First Seen
Sources
Related Entities
Related Claims
Unverified容器技术依赖Linux内核的namespace和cgroup机制实现进程隔离，所有容器共享同一宿主内核80% similarUnverifiedContainerized runtimes use namespace isolation and cgroups constraints to ensure that even when an agent executes arbitrary model-generated code, it cannot break out of the sandbox boundary and affect the host system.77% similarUnverifiedContainers share the host kernel, so kernel vulnerabilities cannot be mitigated by container isolation alone.77% similarVerifiedDocker containers use the Linux kernel's namespace and cgroup mechanisms to create a runtime environment for Agents that is isolated from the host system.75% similarVerified容器技术（以Docker为代表）利用Linux内核的namespace机制实现进程、网络、文件系统隔离，借助cgroups限制CPU、内存等资源用量72% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/1088836API
curl https://kongchang.com/api/v1/knowledge/claims/1088836MCP
get_claim(id=1088836)