Трамп высказался о непростом решении по Ирану09:14
if (minIdx != i) {
，这一点在Line官方版本下载中也有详细论述
（三）提供内容分发服务的，应当采取监测发现、阻断、处置违法信息、网站、应用程序的措施。
For running untrusted code in a multi-tenant environment, like short-lived scripts, AI-generated code, or customer-provided functions, you need a real boundary. gVisor gives you a user-space kernel boundary with good compatibility, while a microVM gives you a hardware boundary with the strongest guarantees. Either is defensible depending on your threat model and performance requirements.
None of this is wrong. These guarantees matter in the browser where streams cross security boundaries, where cancellation semantics need to be airtight, where you do not control both ends of a pipe. But on the server, when you are piping React Server Components through three transforms at 1KB chunks, the cost adds up.