<svg xmlns="http://www.w3.org/2000/svg" width="1200" height="675" viewBox="0 0 1200 675" role="img" aria-labelledby="t d" data-image-type="layered_boundary" data-visual-grammar="architecture-layer">
  <title id="t">K8s容器隔离架构图</title>
  <desc id="d">image_type: layered_boundary; 架构图; 整体架构; 概念关系; target_section: 一句话理解K8s容器隔离原理; purpose: 展示Pod、Namespace、cgroup、安全策略、运行时和宿主机内核之间的隔离关系; reader_task: 区分视图隔离、资源限制、权限收敛和共享内核边界。</desc>
  <defs><style>text{font-family:system-ui,Arial,Helvetica,"Microsoft YaHei",sans-serif;fill:#111827}.bg{fill:#f9fafb}.pod{fill:#eff6ff;stroke:#2563eb;stroke-width:2.5}.ns{fill:#f0f9ff;stroke:#0284c7;stroke-width:2.5}.cg{fill:#ecfdf5;stroke:#059669;stroke-width:2.5}.sec{fill:#fff7ed;stroke:#ea580c;stroke-width:2.5}.rt{fill:#f5f3ff;stroke:#7c3aed;stroke-width:2.5}.kernel{fill:#1f2937;stroke:#111827;stroke-width:2.5}.title{font-size:28px;font-weight:700}.h{font-size:21px;font-weight:700}.p{font-size:16px;fill:#4b5563}.white{fill:#f9fafb}</style></defs>
  <rect class="bg" width="1200" height="675"/>
  <text class="title" x="600" y="86" text-anchor="middle">容器隔离是多层机制叠加</text>
  <text class="p" x="600" y="122" text-anchor="middle">Namespace看视图，cgroup控资源，安全策略收窄权限，内核仍共享</text>
  <rect class="pod" x="140" y="165" width="430" height="120" rx="24"/>
  <text class="h" x="170" y="210">Pod运行单元</text><text class="p" x="170" y="248">共享部分网络与存储视图</text>
  <rect class="ns" x="630" y="165" width="430" height="120" rx="24"/>
  <text class="h" x="660" y="210">Namespace</text><text class="p" x="660" y="248">隔离进程、网络、挂载等视图</text>
  <rect class="cg" x="140" y="340" width="285" height="130" rx="24"/>
  <text class="h" x="170" y="386">cgroup</text><text class="p" x="170" y="424">限制CPU和内存</text><text class="p" x="170" y="452">控制资源边界</text>
  <rect class="sec" x="457" y="340" width="285" height="130" rx="24"/>
  <text class="h" x="487" y="386">安全策略</text><text class="p" x="487" y="424">capabilities</text><text class="p" x="487" y="452">seccomp与AppArmor</text>
  <rect class="rt" x="775" y="340" width="285" height="130" rx="24"/>
  <text class="h" x="805" y="386">容器运行时</text><text class="p" x="805" y="424">创建容器进程</text><text class="p" x="805" y="452">对接宿主机内核</text>
  <rect class="kernel" x="250" y="540" width="700" height="70" rx="20"/>
  <text class="h white" x="600" y="584" text-anchor="middle">共享宿主机内核，需要额外安全边界</text>
</svg>
