chroot and seccomp

In short: chroot changes the apparent root directory for a process, seccomp limits which system calls it may run at all. Both are building blocks of containers and sandboxes.

In more detail: They complement each other: one restricts the visible files, the other the permitted abilities towards the kernel.

In Depth

• chroot: chroot /new/root program makes the program see /new/root as /. Useful for repairs from a live system and for build environments.
• chroot’s limit: Not a security mechanism by itself. With root rights a process can break out. Containers therefore add namespaces.
• seccomp: A filter (seccomp-bpf) allows or denies individual system calls, or kills the process on a forbidden one.
• Use: Browser sandboxes, Docker’s default profile, systemd (SystemCallFilter=).
• Principle: Whoever needs open and read does not need ptrace or mount. That matches the principle of least privilege.

See also: Docker