In this lesson, you will learn how to restrict the system calls (syscalls) available to your containers using Seccomp profiles to shrink your runtime attack surface.
What is Seccomp?
"Seccomp" stands for Secure Computing mode. Every time a process in your container needs to interact with the host operating system—like opening a file, starting a network connection, or killing a process—it must make a syscall to the Linux kernel.
By default, Docker provides a generous list of allowed syscalls. However, most applications only use a tiny fraction of them. If an attacker gains control of your container, they might try to execute dangerous syscalls to escalate privileges or break out of the container entirely. A Seccomp profile acts as a "deny-by-default" firewall for your kernel, allowing only the specific calls your application truly needs.
Applying a Custom Profile
To use a Seccomp profile, you first create a JSON file that explicitly lists which syscalls to allow or deny. You then pass this file to the Docker runtime using the --security-opt flag.
For example, if you want to block the mount syscall (which is a common vector for container breakouts), your JSON profile would define the action as SCMP_ACT_ERRNO for that specific call. When you run your container, you apply it like this:
docker run --security-opt seccomp=/path/to/custom-profile.json my-secure-app
Why This Matters
Think of your container like a restricted office building. Even if someone gets into the lobby (the container), they shouldn't have the keys to every office, the server room, and the master electrical panel (the kernel). By limiting syscalls, you ensure that even if your application is compromised, the attacker is trapped in a room with no tools to do any real damage to the host system.
While Docker provides a sensible default profile that blocks ~40 dangerous syscalls, creating custom profiles for your specific application is the best way to enforce the principle of least privilege at the deepest possible level.
Key Takeaway: By applying a custom Seccomp profile, you enforce a strict "allow-list" of kernel operations, effectively preventing attackers from executing unauthorized system commands even if they gain code execution within your container.