# seccomp

11 Hacker News commenters recommended seccomp and 6 criticized it, November 2025 to November 2026. It was recommended in 7 of 13 months.

**Verdict:** Linux kernel feature that limits which system calls a process can make, recommended as a free, unprivileged layer alongside other sandboxing tools, though critics find its policies hard to write.

## Why people recommend it

- Layers well with other sandboxing tools (2 comments): "Just use the existing sandboxing infrastructure like bubblewrap, seccomp, etc." ([source](https://news.ycombinator.com/item?id=48338689)) "layer on security modules like apparmor and seccomp very easily" ([source](https://news.ycombinator.com/item?id=46503150))

## What people warn about

- Hard to use and easy to misconfigure (6 comments): "This is a LOT of work, of course, and the available APIs don't make it particularly easy or elegant" ([source](https://news.ycombinator.com/item?id=47309695)) "It's barely usable by itself but I don't think it's an inherent problem of seccomp-bpf" ([source](https://news.ycombinator.com/item?id=45945408)) "it's so difficult to use that you get the comfort of knowing that only a very enlightened person could have written your security policy" ([source](https://news.ycombinator.com/item?id=46271217))
- Limited scope, not fit for most uses (2 comments): "it is rather limited, and will require another process to proxy all of these functions" ([source](https://news.ycombinator.com/item?id=46285185)) "it's not fit for purpose outside these extremely niche use cases" ([source](https://news.ycombinator.com/item?id=45953697))

## Cite as

Hacker Approved, "seccomp", https://hackerapproved.com/p/seccomp/ (counts from 1,795,640 Hacker News comments, November 2025 to November 2026).