seccomp

Linux mechanism for restricting which syscalls a process can make. Often layered onto Docker.

Also known as: AppArmor

See also: docker