Container restrictions

Palantir restricts various system calls (syscalls) from running inside our infrastructure through Secure Computing Mode (seccomp). Seccomp is a security feature in the Linux kernel that allows system call (syscall) restrictions to apply to a process or container.

Seccomp filters provide a way to allowlist the syscalls that a container can make and allows for multiple methods of handling non-allowlisted syscalls, including LOG, KILL, and ERRNO profiles:

• LOG allows non-allowlisted syscalls to run but logs them to auditd/osquery for process auditing.
• KILL terminates any process that makes a non-allowlisted syscall.
• ERRNO prevents a syscall from running, but does not generate a logging event.

Seccomp allows us to reduce the attack surface of a container by preventing/logging syscalls considered to be unsafe or that can be used to escape a container. Doing so provides an additional layer of security between the container and the host as well as between containers. Below, you will find a list of the syscalls we automatically block in the Palantir platform.