message: Reduce seccomp container syscall allowlist
diff: @@ -10,32 +10,35 @@ mounts:
  host: /lib64
  /system:
  host: /system
  +io:
  + stdout:
  + log:
  + - DEBUG
  + - seccomp
  seccomp:
  clone: 1
  mmap: arg2 in ~PROT_EXEC || arg2 in ~PROT_WRITE
  prctl: 1
  munmap: 1
  mprotect: arg2 in ~PROT_EXEC || arg2 in ~PROT_WRITE
  - futex: 1
  openat: 1
  close: 1
  - newfstatat: 1
  fstat: 1
  - wait4: 1
  rt_sigaction: 1
  - readlinkat: 1
  - fstatfs: 1
  pread64: 1
  - faccessat: 1
  - write: 1
  - nanosleep: 1
  - getrandom: 1
  read: 1
  execve: 1
  set_tid_address: 1
  - sched_getscheduler: 1
  sigaltstack: 1
  - restart_syscall: 1
  - exit: 1
  exit_group: 1
  - rt_sigreturn: 1
  + stat: 1
  + poll: 1
  + brk: 1
  + rt_sigprocmask: 1
  + access: 1
  + arch_prctl: 1
  + sched_getaffinity: 1
  + set_robust_list: 1
  + prlimit64: 1;
  + write: 1
  + clock_nanosleep: 1
  