Seccomp Syscall Filter Sandbox

Every sandboxing technology — containers, WebAssembly runtimes, microVMs, hardened Linux services — ultimately relies on filtering which system calls a piece of code is allowed to make. This simulator renders that boundary in 3D: a process on one side continuously fires real syscalls (grouped into file, network, process, privilege, memory and device categories) at a policy wall. Set each category to Allow, Trap-log or Kill, dial the syscall rate, and fire an attack burst of genuinely dangerous calls (ptrace, mount, setuid, execve) to see whether your policy actually contains a real privilege-escalation attempt — or whether the process gets sacrificed by a kill-on-sight rule, exactly as SECCOMP_RET_KILL_PROCESS behaves on a real Linux host.