The default seccomp configuration in rkt is not the same. It is based on the Docker one, yes, but as it does not support parameter filtering it is significantly

The default seccomp configuration in rkt is not the same. It is based on the Docker one, yes, but as it does not support parameter filtering it is significantly weaker, eg it allows namespace creation, and all use of the personality syscall, allowing users to disable ASLR.