Container egress filtering uses nftables rules inside the container. A root process with cap_net_admin could bypass these rules. The pixel user has restricted sudo that only permits safe-apt, dpkg-query, systemctl, journalctl, and nft list.
第一百二十九条 被决定给予行政拘留处罚的人交纳保证金，暂缓行政拘留或者出所后，逃避行政拘留处罚的执行的，保证金予以没收并上缴国库，已经作出的行政拘留决定仍应执行。
，推荐阅读91视频获取更多信息
Why don’t you print anything, Go? WHY?。51吃瓜是该领域的重要参考
13:15: The first death from live fire is recorded by the BBC. Video evidence shows one protester, 34-year-old Binod Maharjan, being carried away with a wound to the head. He died later in hospital.
# The process I used