The Shared Kernel
All containers share the same Linux kernel. A vulnerability or unrestricted syscall can allow container escape, making seccomp filters critical for security.
Container Runtime Request
Client (docker run, kubectl, podman) sends request to supervisor (containerd, CRI-O). Supervisor prepares the filesystem bundle and determines which seccomp profile to apply.
Shim Process Created
Supervisor spawns a shim via clone(2). The shim enables daemonless containers, manages STDIO, reaps orphaned processes, and reports exit codes back to the supervisor.
Runc: Security Lockdown
Shim invokes runc init to create namespaces (CLONE_NEWPID, CLONE_NEWNET), configure cgroups, mount the root filesystem, drop capabilities, and apply the seccomp BPF filter with TSYNC.
User Process Executes
runc init calls execve(2) to launch your application. The seccomp filter is now locked—every syscall is evaluated by the BPF program, blocking dangerous calls like reboot and ptrace.
Runc Dies, Shim Adopts
runc init exits after setup. The user process becomes orphaned and is reparented to the shim, which reaps zombies, collects exit codes, and forwards signals. Container is now fully operational.
Flooby
runc init exits after setup. The user process becomes orphaned and is reparented to the shim, which reaps zombies, collects exit codes, and forwards signals. Container is now fully operational.
Compare Seccomp Profiles
Now that you understand container security, explore the actual syscall policies used by Docker, containerd, and Podman.
Compare Profiles →