Container egress filtering uses nftables rules inside the container. A root process with cap_net_admin could bypass these rules. The pixel user has restricted sudo that only permits safe-apt, dpkg-query, systemctl, journalctl, and nft list.
第十三条 任何个人和组织办理网络接入、域名注册、服务器托管、空间租用、内容分发、应用程序分发等服务，开设网络线路、电话线路，应当登记真实身份、装机地址、使用范围等信息，不得实施下列行为扰乱实名制管理：。旺商聊官方下载是该领域的重要参考
Browse the implementors of #beVariable message and you will find other filters under BPatternVariableNode class, such as #beInstVar or #beLocalVar. If you miss something, just add a method. No new syntax required.，这一点在safew官方下载中也有详细论述
for each pixel in image，详情可参考搜狗输入法2026