From 31aef905fa819310ee7694775a836c294ff742e4 Mon Sep 17 00:00:00 2001 From: Ophestra Date: Wed, 2 Jul 2025 04:38:28 +0900 Subject: sandbox: expose seccomp interface There's no point in artificially limiting and abstracting away these options. The higher level hakurei package is responsible for providing a secure baseline and sane defaults. The sandbox package should present everything to the caller. Signed-off-by: Ophestra --- hst/container.go | 2 ++ 1 file changed, 2 insertions(+) (limited to 'hst/container.go') diff --git a/hst/container.go b/hst/container.go index 43d7577a..bc36bef8 100644 --- a/hst/container.go +++ b/hst/container.go @@ -14,6 +14,8 @@ type ( SeccompFlags seccomp.ExportFlag `json:"seccomp_flags"` // extra seccomp presets SeccompPresets seccomp.FilterPreset `json:"seccomp_presets"` + // disable project-specific filter extensions + SeccompCompat bool `json:"seccomp_compat,omitempty"` // allow ptrace and friends Devel bool `json:"devel,omitempty"` // allow userns creation in container -- cgit v1.3.1