GoKawiilKafel Introduces Modular Seccomp Policy Framework for App Sandboxing
A 2025 write-up on software sandboxing basics presents Kafel, a syscall-filtering policy system modeled on Docker's default seccomp profile but refined for unprivileged desktop use. It organizes allowed syscalls into named policy groups—covering areas like async I/O, basic I/O, clocks, and x86 compatibility quirks—drawing inspiration from systemd's seccomp filter sets and OpenBSD's pledge system.