Flashcards
Tap a card to flip it. Term on the front, meaning on the back.
Namespace
Isolates WHAT a process can see (PID / network / mount / UTS).
Cgroup
Caps HOW MUCH a process can use (CPU / memory / I/O / PIDs).
Seccomp-BPF
Filters which syscalls a process may make — before they run.
Timeout
Caps HOW LONG a job may run; kills runaways.
Sandbox Executor
The security core where untrusted code actually runs.
Job Manager
Dispatches tasks to nodes, monitors them, returns results.
Database role
Holds Jobs, Results and Logs — the shared source of truth.
OOM killer
Kills a process when memory runs out; cgroup memory.max can trigger it.
TOCTOU
Check-to-use race; seccomp-BPF avoids it by not dereferencing pointers.
Defense in depth
Four independent walls — an attacker must beat all of them.
中文版