3 ms·

there is no mention of seccomp because virtually no software can utilize it.

• geofft 11y ago
  As a Chrome, systemd, and Sandstorm user, I'm a little curious what you mean.
• kentonv 11y ago
  Sandstorm.io (disclosure: my project) applies mandatory seccomp and other attack surface reduction yet manages to run a lot of apps with only minimal modification: https://docs.sandstorm.io/en/latest/developing/security-practices/#server-sandboxing https://docs.sandstorm.io/en/latest/developing/security-prac... Admittedly, though, "only minimal modification" is probably too much modification for Docker's goals. That's fair. But I don't think that gives them a pass to pretend the problem doesn't exist.
• rwmj 11y ago
  qemu uses seccomp. If you run your VMs with libvirt, then seccomp can be used to protect the host from qemu easily and routinely.
• simoncion 11y ago
  OpenSSH and BIND use seccomp. :)