Linux

Testing

seccomp Profiles: Writing and Testing Syscall Filters for Containers

Every system call a container makes is an attack surface. seccomp (Secure Computing Mode) lets you define exactly which syscalls a container is allowed to make — and kill or log anything outside that list. The challenge is writing profiles that are tight enough to restrict attacker behavior but permissive enough

Testing

AppArmor and SELinux: Testing Mandatory Access Control Policies

Mandatory Access Control (MAC) is what runs underneath discretionary permissions. Even if a process runs as root, AppArmor and SELinux can restrict which files it reads, which network ports it uses, and which capabilities it exercises. For containers, these are critical layers of defense-in-depth. The gap most teams