seccomp

Assume the parser will be exploited, then decide what the exploit gets. The scored design has a disposable worker with nothing worth stealing, no way out, and a narrow, validated return path.

A seccomp filter decides on a system call number and six integers. It cannot read the file path a pointer refers to, and that one limitation shapes every good policy.

Containers are a bundle of kernel features, each limiting a different thing. The scored answer explains what each restricts, what it does not, and how to combine them for an untrusted workload.