Many administrators turn off seccomp on their containerization platform in a trade-off with ease of use/application.
However turning off such a basic security setting that is so heavily tied to sandboxing is, to some extend, defeating the purpose of containerization. From a security/stability point of view I would think it to be wise to keep blacklisting most of the system calls when running the LXC/Docker containers on servers (as configured by LXC defaults in
2 blacklist [all] kexec_load errno 1 open_by_handle_at errno 1 init_module errno 1 finit_module errno 1 delete_module errno 1
Does not 'loading seccomp rules for LXC containers' yield:
- significant * security issues?
- any other technical (application or stability) issues?
*Bonus question: What would be the risks when assuming one is the only one using the "mother" system and its LXC containers (e.g. in an experimental test laboratory, where it may be less evident to have multiple users, but containerization still offers many benefits such as easy snapshoting / cloning of experimental environments)?