Aqua 3.2: Preventing Container Breakouts with Dynamic System Call Profiling

Aqua's article explains Linux syscalls and the seccomp whitelist model, then presents Aqua 3.2's automated dynamic syscall-profiling feature that creates custom seccomp profiles for containers. The vendor claims the profiler typically reduces usable syscalls to roughly 40–70 (from ~313), cutting the attack surface by an estimated 80–90% and helping prevent kernel-exploit-based container breakouts (e.g., DirtyC0W).