A symlink attack via Chart.lock allowed local code execution when running helm dependency update, fixed in v3.18.4. Malicious Helm charts have been used to exploit Argo CD and steal secrets from deployments.
Docker applies a default seccomp profile that blocks around 40 to 50 syscalls. This meaningfully reduces the attack surface. But the key limitation is that seccomp is a filter on the same kernel. The syscalls you allow still enter the host kernel’s code paths. If there is a vulnerability in the write implementation, or in the network stack, or in any allowed syscall path, seccomp does not help.
。业内人士推荐新收录的资料作为进阶阅读
19:19, 9 марта 2026РоссияЭксклюзив，更多细节参见新收录的资料
Артём Верейкин (Ночной линейный редактор)，这一点在新收录的资料中也有详细论述
Что думаешь? Оцени!