Software sandboxing: The basics

• // These policies are heavily influenced by Docker's default profile.
• Further // customization done on top: // // - Avoid syscalls that need root anyway.
• The policies here are mostly meant to // be used by unprivileged users (not containers with root inside).