seccomp, or secure computing, is a Linux syscall that aims to improve system security. By using seccomp, a process can limit the system calls available to itself.
There are two seccomp modes with different trade-offs, these are called Strict Mode and Filter Mode.
Strict mode is the original seccomp mode that was available before the introduction of filter mode. In strict mode, the only system calls that a process is permitted to make are read, write, exit and sigreturn. Attempting to perform any other system call results in the process getting terminated with a SIGKILL.
Filter mode allows more granular control of system calls by checking every syscall through a BPF program.