Problem Statement
NemoClaw does not define or apply a custom seccomp profile. The sandbox relies on whatever the container runtime (Docker/containerd) provides by default.
Impact
The default Docker seccomp profile allows ~300 of ~450 available syscalls. Many are unnecessary for agent workloads and present attack surface:
mount / umount — filesystem manipulationptrace — process debugging/injectionclone with CLONE_NEWUSER — user namespace creationkeyctl — kernel keyring access
Proposed Design
Define a restrictive seccomp profile that only allows syscalls needed for agent operations:
{
"defaultAction": "SCMP_ACT_ERRNO",
"architectures": ["SCMP_ARCH_X86_64"],
"syscalls": [
{"names": ["read", "write", "open", "close", "stat", "fstat", ...], "action": "SCMP_ACT_ALLOW"},
]
}Apply via Docker: --security-opt seccomp=nemoclaw-seccomp.json
References
- CIS Docker Benchmark 5.21: "Do not disable default seccomp profile"
- Docker documentation: Custom seccomp profiles
Alternatives Considered
No response
Category
enhancement: feature
Checklist
Problem Statement
NemoClaw does not define or apply a custom seccomp profile. The sandbox relies on whatever the container runtime (Docker/containerd) provides by default.
Impact
The default Docker seccomp profile allows ~300 of ~450 available syscalls. Many are unnecessary for agent workloads and present attack surface:
mount/umount— filesystem manipulationptrace— process debugging/injectionclonewithCLONE_NEWUSER— user namespace creationkeyctl— kernel keyring accessProposed Design
Define a restrictive seccomp profile that only allows syscalls needed for agent operations:
{ "defaultAction": "SCMP_ACT_ERRNO", "architectures": ["SCMP_ARCH_X86_64"], "syscalls": [ {"names": ["read", "write", "open", "close", "stat", "fstat", ...], "action": "SCMP_ACT_ALLOW"}, ] }Apply via Docker:
--security-opt seccomp=nemoclaw-seccomp.jsonReferences
Alternatives Considered
No response
Category
enhancement: feature
Checklist