Container security fundamentals part 6: seccomp

This post explains how Docker leverages seccomp (BPF-based) filters to restrict Linux syscalls as a last defense layer in containers, illustrating how the default profile blocks risky calls like `unshare` (e.g., mitigating issues like CVE-2022-0185) and how to create and apply custom JSON seccomp profiles. It covers disabling the default filter, tailoring policies to block families such as `io_uring`, and generating allowlists from syscall audits to strengthen container security without disrupting workflows.