接下来，在公共模块（common module）的 build.gradle.kts 文件中，我们需要做三件事：应用插件、添加运行时依赖和配置 Wire。
Network egress control — compute isolation means nothing if the sandbox can freely phone home. Options range from disabling networking entirely, to running an allowlist proxy (like Squid) that blocks DNS resolution inside the sandbox and forces all traffic through a domain-level allowlist, to dropping CAP_NET_RAW so the sandbox cannot bypass DNS with raw sockets.，更多细节参见同城约会
images that are suitable for commercial use.。业内人士推荐heLLoword翻译官方下载作为进阶阅读
The word “isolation” gets used loosely. A Docker container is “isolated.” A microVM is “isolated.” A WebAssembly module is “isolated.” But these are fundamentally different things, with different boundaries, different attack surfaces, and different failure modes. I wanted to write down my learnings on what each layer actually provides, because I think the distinctions matter and allow you to make informed decisions for the problems you are looking to solve.
depending on the task description and it is important to review and test the