{"action":"created","issue":{"url":"https://api.github.com/repos/subuser-security/subuser/issues/269","repository_url":"https://api.github.com/repos/subuser-security/subuser","labels_url":"https://api.github.com/repos/subuser-security/subuser/issues/269/labels{/name}","comments_url":"https://api.github.com/repos/subuser-security/subuser/issues/269/comments","events_url":"https://api.github.com/repos/subuser-security/subuser/issues/269/events","html_url":"https://github.com/subuser-security/subuser/issues/269","id":128339852,"number":269,"title":"Seccomp support","user":{"login":"ypid","id":1301158,"avatar_url":"https://avatars.githubusercontent.com/u/1301158?v=3","gravatar_id":"","url":"https://api.github.com/users/ypid","html_url":"https://github.com/ypid","followers_url":"https://api.github.com/users/ypid/followers","following_url":"https://api.github.com/users/ypid/following{/other_user}","gists_url":"https://api.github.com/users/ypid/gists{/gist_id}","starred_url":"https://api.github.com/users/ypid/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ypid/subscriptions","organizations_url":"https://api.github.com/users/ypid/orgs","repos_url":"https://api.github.com/users/ypid/repos","events_url":"https://api.github.com/users/ypid/events{/privacy}","received_events_url":"https://api.github.com/users/ypid/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":{"url":"https://api.github.com/repos/subuser-security/subuser/milestones/8","html_url":"https://github.com/subuser-security/subuser/milestones/0.6","labels_url":"https://api.github.com/repos/subuser-security/subuser/milestones/8/labels","id":1255490,"number":8,"title":"0.6","description":"- Rework backend to use runc, repeatr\r\n- Divide out subuser runtime from rest of code","creator":{"login":"timthelion","id":1391608,"avatar_url":"https://avatars.githubusercontent.com/u/1391608?v=3","gravatar_id":"","url":"https://api.github.com/users/timthelion","html_url":"https://github.com/timthelion","followers_url":"https://api.github.com/users/timthelion/followers","following_url":"https://api.github.com/users/timthelion/following{/other_user}","gists_url":"https://api.github.com/users/timthelion/gists{/gist_id}","starred_url":"https://api.github.com/users/timthelion/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/timthelion/subscriptions","organizations_url":"https://api.github.com/users/timthelion/orgs","repos_url":"https://api.github.com/users/timthelion/repos","events_url":"https://api.github.com/users/timthelion/events{/privacy}","received_events_url":"https://api.github.com/users/timthelion/received_events","type":"User","site_admin":false},"open_issues":13,"closed_issues":2,"state":"open","created_at":"2015-08-14T16:53:22Z","updated_at":"2016-01-31T08:45:46Z","due_on":null,"closed_at":null},"comments":4,"created_at":"2016-01-23T17:17:35Z","updated_at":"2016-02-13T10:53:33Z","closed_at":null,"body":"It seems that Docker currently does not support seccomp filters and thus also subuser. Somewhat related to https://github.com/subuser-security/subuser/issues/245\r\nThis is pretty bad for sandboxing because most kernel exploits use some obscure syscalls. See also: https://l3net.wordpress.com/2016/01/20/firejail-target-practice-cve-2016-0728/"},"comment":{"url":"https://api.github.com/repos/subuser-security/subuser/issues/comments/183641845","html_url":"https://github.com/subuser-security/subuser/issues/269#issuecomment-183641845","issue_url":"https://api.github.com/repos/subuser-security/subuser/issues/269","id":183641845,"user":{"login":"raesene","id":68317,"avatar_url":"https://avatars.githubusercontent.com/u/68317?v=3","gravatar_id":"","url":"https://api.github.com/users/raesene","html_url":"https://github.com/raesene","followers_url":"https://api.github.com/users/raesene/followers","following_url":"https://api.github.com/users/raesene/following{/other_user}","gists_url":"https://api.github.com/users/raesene/gists{/gist_id}","starred_url":"https://api.github.com/users/raesene/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/raesene/subscriptions","organizations_url":"https://api.github.com/users/raesene/orgs","repos_url":"https://api.github.com/users/raesene/repos","events_url":"https://api.github.com/users/raesene/events{/privacy}","received_events_url":"https://api.github.com/users/raesene/received_events","type":"User","site_admin":false},"created_at":"2016-02-13T10:53:33Z","updated_at":"2016-02-13T10:53:33Z","body":"I actually think that Docker vendors in seccomp support from runc (although I may be misreading this...)\r\n\r\nhttps://github.com/opencontainers/runc/blob/master/libcontainer/seccomp/seccomp_linux.go"}}