#seccomp

Seccomp Filters on Linux: Reducing the System-Call Surface Without Creating a Sandbox Myth

A precise guide to Linux seccomp-BPF actions, filter layering, argument limits, no_new_privs, observability, and the controls a real sandbox still needs.