Containers: Sandboxing

"Jail" containers by restricting CAPabilities and syscalls they can call

Reduce attack surface

# minijail0 -S /usr/share/minijail0/${uname -m}/cat.policy -- \
/bin/cat /proc/self/seccomp_filter

# open with O_LARGEFILE|O_RDONLY|O_NONBLOCK or some combination.

open: arg1 == 32768 || arg1 == 0 || arg1 == 34816 || arg1 == 2048

mmap2: arg2 == 0x0

munmap: 1

close: 1

Reduce attack surface by using seccomp filters