container-security-hardening

This file defines an explicitly experimental, broad seccomp allowlist, not malware or a hardened runtime policy. It permits process execution and creation, filesystem modification, networking, and kernel interfaces including ioctl and io_uring, increasing attack surface if applied to an exposed workload. The unconfined discovery example disables seccomp only for the stated isolated test scenario. Use RuntimeDefault or a narrowly tested profile; no credential theft, exfiltration destination, or destructive behavior is present in the configuration itself.