<svg xmlns="http://www.w3.org/2000/svg" width="1200" height="675" viewBox="0 0 1200 675"><rect width="1200" height="675" fill="#f4fbff"/><text x="70" y="82" font-size="34" font-weight="700" fill="#0f3b57">非root容器最小权限配置总览</text><text x="70" y="123" font-size="20" fill="#4d7284">从镜像用户到集群准入的权限收敛路径</text><rect x="90" y="190" width="280" height="290" rx="28" fill="#ffffff" stroke="#2a9d8f" stroke-width="4"/><rect x="460" y="160" width="280" height="350" rx="28" fill="#e7f5ff" stroke="#1c7ed6" stroke-width="4"/><rect x="830" y="190" width="280" height="290" rx="28" fill="#fff3bf" stroke="#f59f00" stroke-width="4"/><path d="M385 335 H445" stroke="#2a9d8f" stroke-width="7"/><path d="M755 335 H815" stroke="#2a9d8f" stroke-width="7"/><text x="160" y="290" font-size="28" font-weight="700" fill="#0f3b57">镜像构建</text><text x="145" y="350" font-size="21" fill="#24566b">固定UID</text><text x="145" y="390" font-size="21" fill="#24566b">目录属主</text><text x="520" y="255" font-size="28" font-weight="700" fill="#0f3b57">运行时约束</text><text x="510" y="320" font-size="21" fill="#24566b">runAsNonRoot</text><text x="510" y="360" font-size="21" fill="#24566b">drop ALL</text><text x="510" y="400" font-size="21" fill="#24566b">只读根文件系统</text><text x="900" y="290" font-size="28" font-weight="700" fill="#0f3b57">准入治理</text><text x="890" y="350" font-size="21" fill="#24566b">策略阻断</text><text x="890" y="390" font-size="21" fill="#24566b">持续审计</text><rect x="250" y="555" width="700" height="54" rx="27" fill="#0f3b57"/><text x="380" y="590" font-size="22" fill="#ffffff">目标：入侵后也难以写入、提权、横向移动</text></svg>