seccomp: Docker incompatibility: containerd profile does not contain get_mempolicy, mbind, set_mempolicy even when CAP_SYS_NICE is granted #7150
Description
{
LinuxSyscall: specs.LinuxSyscall{
Names: []string{
"get_mempolicy",
"mbind",
"set_mempolicy",
},
Action: specs.ActAllow,
},
Includes: &Filter{
Caps: []string{"CAP_SYS_NICE"},
},
},
The containerd profile does not seem to contain the syscalls above.
https://github.com/containerd/containerd/blob/main/contrib/seccomp/seccomp_default.go
Not sure if this was accidental or on purpose.