1．报送时机：船舶进入上述区域前开始报送，船舶离开上述后取消报送。
The critical thing to understand is namespaces are visibility walls, not security boundaries. They prevent a process from seeing things outside its namespace. They do not prevent a process from exploiting the kernel that implements the namespace. The process still makes syscalls to the same host kernel. If there is a bug in the kernel’s handling of any syscall, the namespace boundary does not help.
，这一点在同城约会中也有详细论述
Your application doesn’t change at all. It still reads process.env.API_KEY or $DATABASE_URL the same way it always did. The difference is where the values come from.
对比生长激素的庞大市场，“阴伟达” 顶多是个 “小众爆款”，根本替代不了核心业务的缺口。