https://www.scrivano.org/tags/easyseccomp/ Recent content in Easyseccomp on *scratch* Hugo en Sat, 06 Jun 2026 10:03:54 +0000 https://www.scrivano.org/posts/2021-01-30-easyseccomp/ Sat, 30 Jan 2021 21:10:14 +0200 https://www.scrivano.org/posts/2021-01-30-easyseccomp/ <p>Seccomp is a kernel feature that restricts what syscalls can be used by a process. The allowed syscalls are described as a BPF program that the kernel evaluates on every syscall entry. While effective, writing and maintaining seccomp profiles in the JSON format expected by OCI runtimes is tedious, and the underlying libseccomp API has surprising constraints — particularly around combining per-argument rules for the same syscall — that make complex policies difficult to express correctly.</p> <p>Almost every container runs with seccomp enabled to restrict its access to syscalls.</p>