Cgroups are important for stability, but they are not a security boundary. They prevent denial-of-service, not escape. A process constrained by cgroups still makes syscalls to the same kernel with the same attack surface.
英國超市將巧克力鎖進防盜盒阻止「訂單式」偷竊
，这一点在夫子中也有详细论述
Browser extensions and MS word add-ons
(Image credit: Future)In essence, while the bill doesn't seem to require the most egregious forms of age verification (face scans or similar), it does require OS providers to collect age verification of some form at the account/user creation stage—and to be able to pass a segmented version of that information to outside developers upon request.