Per-job PID + mount + IPC namespaces via clone3 — so each execution is isolated from other executions inside the same gVisor sandbox
More articles by Ryan Hunt…
，更多细节参见safew官方版本下载
can reuse the array when ((union alloc_header *)data)[-1].ref is zero.
• The best running shoes, tested