A major limitation of seccomp is that you can't turn off inheritance. With pledge inheritance is opt-in. This has major consequences because it makes it possib

A major limitation of seccomp is that you can't turn off inheritance. With pledge inheritance is opt-in. This has major consequences because it makes it possible for a process to secure itself without affecting its ability to spawn child processes. You could apply seccomp in-process or use a spawn-helper before securing it. But more realistically it means that one applies an external seccomp profile to a group of processes (e.g. a container) that contains the union of all needed syscalls. So while seccomp is more flexible in some sense (being able to run BPF filters on every syscall) its architecture leads to it being applied in a less flexible way.