2025年以来全球开源智能体生态的加速爆发。2026年1月走红的OpenClaw项目，以14万GitHub Star和2万Fork的速度，向市场普及了“AI能干活的想象力”，它能跳出浏览器，深入操作系统底层移动文件、管理日历、执行脚本。但OpenClaw直接操作宿主机的模式，也让不少企业在安全层面望而却步。
Exploration of the Moon
。业内人士推荐heLLoword翻译官方下载作为进阶阅读
NamespaceWhat it isolatesWhat the process seesPIDProcess IDsOwn process tree, starts at PID 1MountFilesystem mount pointsOwn mount table, can have different rootNetworkNetwork interfaces, routingOwn interfaces, IP addresses, portsUserUID/GID mappingCan be root inside, nobody outsideUTSHostnameOwn hostnameIPCSysV IPC, POSIX message queuesOwn shared memory, semaphoresCgroupCgroup root directoryOwn cgroup hierarchyTimeSystem clocks (monotonic, boot)Own system uptime and clock offsetsNamespaces are what Docker containers use. When you run a container, it gets its own PID namespace (cannot see host processes), its own mount namespace (own filesystem view), its own network namespace (own interfaces), and so on.
聚众实施前款行为的，对首要分子处十日以上十五日以下拘留，可以并处二千元以下罚款。
slowness, heap allocations. Each time a Go program allocates memory