Provides easy-to-use Linux seccomp-bpf jailing.

DSL language to write seccomp filters

A portable version of OpenBSD's privsep/sandboxed file(1) utility

A lightweight process isolation tool, requiring absolutely no privileges to run

trace and intercept linux syscalls.

force-bind with seccomp-bpf notifications

Automated Approach for Generation of Seccomp System Call Filters

Go library to reduce privileges on Linux by syscall groups through seccomp-bpf.

A survey and analysis of source code sandboxing