<svg xmlns="http://www.w3.org/2000/svg" width="960" height="540" viewBox="0 0 960 540" role="img" aria-labelledby="title desc">
  <title id="title">Namespaces 与 Cgroups 在容器隔离中的分工</title>
  <desc id="desc">展示 Namespace 负责进程可见范围，Cgroups 负责资源限制，两者共同支撑容器隔离。</desc>
  <defs>
    <linearGradient id="bg" x1="0" x2="1" y1="0" y2="1"><stop stop-color="#0f172a"/><stop offset="1" stop-color="#1e3a8a"/></linearGradient>
    <filter id="shadow"><feDropShadow dx="0" dy="10" stdDeviation="12" flood-opacity="0.22"/></filter>
  </defs>
  <rect width="960" height="540" rx="28" fill="url(#bg)"/>
  <text x="480" y="58" fill="#fff" font-size="30" font-weight="700" text-anchor="middle" font-family="Arial,'Microsoft YaHei',sans-serif">容器隔离 = 可见范围隔离 + 资源使用控制</text>
  <g filter="url(#shadow)">
    <rect x="70" y="105" width="370" height="330" rx="24" fill="#eff6ff"/>
    <rect x="520" y="105" width="370" height="330" rx="24" fill="#ecfdf5"/>
  </g>
  <text x="255" y="150" fill="#1d4ed8" font-size="28" font-weight="700" text-anchor="middle" font-family="Arial,'Microsoft YaHei',sans-serif">Namespaces</text>
  <text x="705" y="150" fill="#047857" font-size="28" font-weight="700" text-anchor="middle" font-family="Arial,'Microsoft YaHei',sans-serif">Cgroups</text>
  <text x="255" y="188" fill="#334155" font-size="17" text-anchor="middle" font-family="Arial,'Microsoft YaHei',sans-serif">决定容器进程“能看到什么”</text>
  <text x="705" y="188" fill="#334155" font-size="17" text-anchor="middle" font-family="Arial,'Microsoft YaHei',sans-serif">决定容器进程“能用多少”</text>
  <g font-family="Arial,'Microsoft YaHei',sans-serif" font-size="18" fill="#0f172a">
    <rect x="115" y="225" width="280" height="42" rx="12" fill="#dbeafe"/><text x="255" y="252" text-anchor="middle">PID：独立进程编号视图</text>
    <rect x="115" y="280" width="280" height="42" rx="12" fill="#dbeafe"/><text x="255" y="307" text-anchor="middle">Network：独立网络栈</text>
    <rect x="115" y="335" width="280" height="42" rx="12" fill="#dbeafe"/><text x="255" y="362" text-anchor="middle">Mount / UTS / IPC / User</text>
    <rect x="565" y="225" width="280" height="42" rx="12" fill="#d1fae5"/><text x="705" y="252" text-anchor="middle">CPU：权重与配额</text>
    <rect x="565" y="280" width="280" height="42" rx="12" fill="#d1fae5"/><text x="705" y="307" text-anchor="middle">Memory：上限与 OOM</text>
    <rect x="565" y="335" width="280" height="42" rx="12" fill="#d1fae5"/><text x="705" y="362" text-anchor="middle">IO / PIDs / Device 控制</text>
  </g>
  <path d="M440 270 C470 250 490 250 520 270" stroke="#fbbf24" stroke-width="6" fill="none" stroke-linecap="round"/>
  <text x="480" y="472" fill="#cbd5e1" font-size="18" text-anchor="middle" font-family="Arial,'Microsoft YaHei',sans-serif">两者共同作用于同一组容器进程，但职责边界不同</text>
</svg>
