microG microg.org🌐
Global news & analysis
。业内人士推荐safew官方下载作为进阶阅读
For running untrusted code in a multi-tenant environment, like short-lived scripts, AI-generated code, or customer-provided functions, you need a real boundary. gVisor gives you a user-space kernel boundary with good compatibility, while a microVM gives you a hardware boundary with the strongest guarantees. Either is defensible depending on your threat model and performance requirements.
For now, Apple isn't saying much, and it's possible I'm overthinking the crumbs they've given us.