config.yml

defaultAction: SCMP_ACT_ERRNO
architectures:
  - SCMP_ARCH_X86_64
  - SCMP_ARCH_X86
# System calls from the default docker ruleset, they should be blocked anyway
defaultDeny:
  - acct
  - add_key
  - adjtimex
  - bpf
  - clock_adjtime
  - clock_settime
  - clone
  - create_module
  - delete_module
  - finit_module
  - get_kernel_syms
  - get_mempolicy
  - init_module
  - ioperm
  - iopl
  - kcmp
  - kexec_file_load
  - kexec_load
  - keyctl
  - lookup_dcookie
  - mbind
  - mount
  - move_pages
  - name_to_handle_at
  - nfsservctl
  - open_by_handle_at
  - perf_event_open
  - personality
  - pivot_root
  - process_vm_readv
  - process_vm_writev
  - ptrace
  - query_module
  - quotactl
  - reboot
  - request_key
  - set_mempolicy
  - setns
  - settimeofday
  - stime
  - swapon
  - swapoff
  - sysfs
  - _sysctl
  - umount
  - umount2
  - unshare
  - uselib
  - userfaultfd
  - ustat
  - vm86
  - vm86