据新华社电 中央军委晋升上将军衔仪式23日在北京八一大楼举行。中央军委主席习近平出席晋衔仪式。上午10时许，晋衔仪式在庄严的中华人民共和国国歌声中开始。中央军委副主席张又侠宣读了中央军委主席习近平签署的晋升上将军衔命令。中央军委副主席何卫东主持晋衔仪式。习近平向晋升上将军衔的陆军政治委员陈辉颁发命令状，表示祝贺。佩戴了上将军衔的陈辉向习近平敬礼，向参加仪式的全体同志敬礼，全场响起热烈掌声。晋衔仪式在嘹亮的中国人民解放军军歌声中结束。中央军委委员刘振立、张升民，军委机关各部门、军队驻京有关单位主要负责同志等参加晋衔仪式。SourcePh" style="display:none"
If you enable --privileged just to get CAP_SYS_ADMIN for nested process isolation, you have added one layer (nested process visibility) while removing several others (seccomp, all capability restrictions, device isolation). The net effect is arguably weaker isolation than a standard unprivileged container. This is a real trade-off that shows up in production. The ideal solutions are either to grant only the specific capability needed instead of all of them, or to use a different isolation approach entirely that does not require host-level privileges.
，这一点在雷电模拟器官方版本下载中也有详细论述
Limited-Edition
Server[HotAudio Server] --|Sends Encrypted audio chunks| JS[JavaScript Player]