John is a senior network security administrator working at a multinational company.

Seccomp, which stands for secure computing mode, is a Linux kernel feature that enables the restriction of a process’s system calls (syscalls). It provides a means to sandbox the privileges of a process, thereby limiting the calls it can make from userspace into the kernel. This feature is particularly useful for enhancing the security of containers by restricting the syscalls that container binaries are allowed to execute, thus preventing potential exploitation of syscall vulnerabilities.

References: The explanation is based on the Kubernetes documentation, which outlines how to restrict a container’s syscalls with seccomp, and confirms its stability since Kubernetes v1.191. Further information can be found in the Kubernetes tutorial on seccomp2, and AWS documentation that describes seccomp as a feature for restricting unauthorized syscalls by programs3.