用本地模型可降 API 成本，但会增加本机资源消耗
├── Containerfile
，这一点在服务器推荐中也有详细论述
（二）明确网络犯罪生态治理制度。网络犯罪黑灰产与网络犯罪依附共生、利益共享，极大降低了网络犯罪门槛。由于缺乏明确法律依据，对黑灰产团伙往往难以依法治理。《网络犯罪防治法（征求意见稿）》立足网络犯罪黑灰产现状，对其中起到基础作用的网络支付、引流推广等黑灰产业链条予以法律规制，为打击治理网络犯罪生态提供进一步法律支撑。
Running a container in privileged modeThis is worth calling out because it comes up surprisingly often. Some isolation approaches require Docker’s privileged flag. For example, building a custom sandbox that uses nested PID namespaces inside a container often leads developers to use privileged mode, because mounting a new /proc filesystem for the nested sandbox requires the CAP_SYS_ADMIN capability (unless you also use user namespaces).