Docker by default also applies a seccomp system call whitelist per [1] and restricts capabilities per [2], amongst numerous other default hardening practices th

Docker by default also applies a seccomp system call whitelist per [1] and restricts capabilities per [2], amongst numerous other default hardening practices that are applied. If a Docker container really had a need to call the "reboot" system call, this permission could be explicitly added. More complex sandboxing techniques include opening handles for sockets, pipes, files, etc and then hardening seccomp filters on top to prevent any new handles being opened. In this way, some containers can read/write defined files on a volume without having any ability to otherwise interact with file systems such as opening new files (all file system related system calls could be disabled). [1] https://github.com/moby/moby/blob/master/profiles/seccomp/default.json https://github.com/moby/moby/blob/master/profiles/seccomp/de... [2] https://docs.docker.com/engine/security/#linux-kernel-capabilities https://docs.docker.com/engine/security/#linux-kernel-capabi...