Can you explain why you think that seccomp is even related to chroot? The two are very different technologies with very different goals (in fact, chroot's origi

Can you explain why you think that seccomp is even related to chroot? The two are very different technologies with very different goals (in fact, chroot's original goal was _not_ security -- it was a clever hack by Bill Joy in the 80s to allow compiling BSDs on older BSDs...). Even if we pretend that chroots are designed for isolation, seccomp is not. Seccomp is designed to be part of a sandboxing system. Capsicum is a new way of dealing with processes that require privileges. And pledge is sort of like seccomp but with questionable granularity. The point is that sure you can call them "security systems" because they are all based on the idea of blocking things, but that's like saying that bananas and humans are all carbon-based life -- it's technically accurate but not very helpful. Especially since you then go on to talk about the isolation aspects of chroot -- which is something that seccomp, pledge and Capsicum do not give you.