seccomp
Syscall filter in Privacy & security
Linux kernel feature that limits which system calls a process can make, recommended as a free, unprivileged layer alongside other sandboxing tools, though critics find its policies hard to write.
Linux kernel feature that limits which system calls a process can make, recommended as a free, unprivileged layer alongside other sandboxing tools, though critics find its policies hard to write.
17 people gave an opinion
- recommend it
- 11
- criticize it
- 6
- approval share
- 65%
Recommended in 7 of 13 months
- November 2025: recommended
- December 2025: not recommended
- January 2026: recommended
- February 2026: not recommended
- March 2026: recommended
- April 2026: recommended
- May 2026: recommended
- June 2026: not recommended
- July 2026: not recommended
- August 2026: recommended
- September 2026: recommended
- October 2026: not recommended
- November 2026: not recommended (month in progress)
Why it doesn’t carry the badge
- 11 people recommend itNeeds 10 or more, met.
- 1.8 recommenders for every criticNeeds 2 to 1 or better, not met.
- Recommended in 7 of 13 monthsNeeds 4 or more, met.
The same three rules apply to every product, and the badge can’t be bought. How the badge works
What people say about it
The reasons people give, with the number of comments that give each one. Open a reason to read what they said.
Why people recommend it
Each mark is one comment
Layers well with other sandboxing tools
“Just use the existing sandboxing infrastructure like bubblewrap, seccomp, etc.”
Comment from 30 May 2026 in “MCP Is Dead” “layer on security modules like apparmor and seccomp very easily”
Comment from 5 Jan 2026 in “Sandboxing Untrusted Python”
What people warn about
Each mark is one comment
Hard to use and easy to misconfigure
“This is a LOT of work, of course, and the available APIs don't make it particularly easy or elegant”
Comment from 9 Mar 2026 in “FreeBSD Capsicum vs. Linux Seccomp Process Sandboxing” “It's barely usable by itself but I don't think it's an inherent problem of seccomp-bpf”
Comment from 16 Nov 2025 in “Why use OpenBSD?” “it's so difficult to use that you get the comfort of knowing that only a very enlightened person could have written your security policy”
Comment from 15 Dec 2025 in “Linux Sandboxes and Fil-C” - Comment from 9 Mar 2026 in “FreeBSD Capsicum vs. Linux Seccomp Process Sandboxing”
- Comment from 9 Mar 2026 in “FreeBSD Capsicum vs. Linux Seccomp Process Sandboxing”
- Comment from 16 Nov 2025 in “Why use OpenBSD?”
Limited scope, not fit for most uses
“it is rather limited, and will require another process to proxy all of these functions”
Comment from 16 Dec 2025 in “Problems with D-Bus on the Linux desktop” “it's not fit for purpose outside these extremely niche use cases”
Comment from 17 Nov 2025 in “Why use OpenBSD?”
What people said
18 of the 23 comments that mention it, newest first. Each links to the original comment.
“Landlock and seccomp are really cool.”
“I just wish seccomp worked per user”
“Vanilla seccomp is sufficient and runs at full performance.”
“Seccomp and gVisor need no privileges.”
“additional seccomp can go a long way”
“seccomp has existed for ages but is rarely deployed”
“Just use the existing sandboxing infrastructure like bubblewrap, seccomp, etc.”
“Seccomp also kills this CVE.”
“mostly missing from the tools we have (apparmor, seccomp, oss VMs, seatbelt, docker, bubblewrap etc.)”
“that quickly becomes error prone once you factor in syscall variants and helper calls”
“I find seccomp unusable and not fit for purpose”
“This is a LOT of work, of course, and the available APIs don't make it particularly easy or elegant”
“layer on security modules like apparmor and seccomp very easily”
“it is rather limited, and will require another process to proxy all of these functions”
“it's so difficult to use that you get the comfort of knowing that only a very enlightened person could have written your security policy”
“it's not fit for purpose outside these extremely niche use cases”
“It's barely usable by itself but I don't think it's an inherent problem of seccomp-bpf”
“Seccomp was never actually usable”
Counts come from 1,795,640 Hacker News comments, November 2025 to November 2026. How we count. Report a mistake.