BestHub
Sign in
Tagged articles
10 articles
Page 1 of 1
SuanNi
SuanNi
Apr 22, 2026 · Information Security

How ClawLess Secures Autonomous AI Agents with Formal System‑Call Isolation

The ClawLess framework, developed by researchers from Southern University of Science and Technology and Hong Kong University of Science and Technology, combines formal security policies, physical sandboxing, user‑space kernels and BPF‑based system‑call interception to protect highly autonomous AI agents from rogue behavior and external attacks.

AI SafetyBPFcontainer isolation
0 likes · 11 min read
How ClawLess Secures Autonomous AI Agents with Formal System‑Call Isolation
mikechen
mikechen
Sep 18, 2025 · Cloud Native

How Docker Achieves Container Isolation with Namespaces and Cgroups

This article explains how Docker uses Linux kernel features—Namespaces for process isolation and Control Groups (cgroups) for resource limiting—to build a secure, lightweight container runtime, detailing their mechanisms, key structures, and practical configuration examples.

DockerNamespacescontainer isolation
0 likes · 5 min read
How Docker Achieves Container Isolation with Namespaces and Cgroups
Open Source Linux
Open Source Linux
Jul 3, 2024 · Cloud Native

How Docker Uses PID Namespaces to Isolate Containers: A Deep Dive

This article explains Docker’s core isolation mechanisms, focusing on how Cgroups and PID namespaces create separate process spaces, demonstrating with Ubuntu container commands, and clarifying why each container sees its own PID 1 despite the host’s actual process IDs.

DockerLinuxNamespace
0 likes · 6 min read
How Docker Uses PID Namespaces to Isolate Containers: A Deep Dive
macrozheng
macrozheng
Feb 8, 2021 · Cloud Native

Unlock Docker Isolation: Exploring Linux’s 8 Namespace Types

This article explains how Linux namespaces provide fine‑grained isolation for Docker containers, detailing the eight namespace types, demonstrating practical unshare commands for pid, mount, uts, ipc, user, and net namespaces, and highlighting the role of cgroups for resource limits.

DockerLinux NamespacesOperating System
0 likes · 8 min read
Unlock Docker Isolation: Exploring Linux’s 8 Namespace Types
Efficient Ops
Efficient Ops
Feb 2, 2021 · Cloud Native

Unlocking Linux Namespaces: How Docker Leverages Classic Isolation Techniques

This article explains how Docker relies on Linux's eight namespace types and cgroups to achieve fine‑grained isolation, demonstrates practical unshare commands for PID, mount, UTS, IPC, user, and network namespaces, and highlights the role of namespaces in container security and resource management.

Dockercgroupcontainer isolation
0 likes · 7 min read
Unlocking Linux Namespaces: How Docker Leverages Classic Isolation Techniques