Answer
It blocks dangerous syscalls but still allows many exploitable ones; hardened profiles are needed for secure environments.
Quick Answer
Docker's default seccomp profile blocks about 44 of the ~300+ Linux syscalls — ones rarely needed by containers but dangerous if available: keyctl, ptrace, kexec_load, mount, unshare. It doesn't block everything risky, leaving many syscalls open for compatibility. A custom, tighter profile significantly hardens containers.
S
SugharaIQ Editorial Team
Verified Answer
This answer has been peer-reviewed by industry experts holding senior engineering roles to ensure technical accuracy and relevance for modern interview standards.
Want to bookmark, take notes, or join discussions?
Sign in to access all features and personalize your learning experience.
Source: SugharaIQ