Minimal seccomp profile for Docker container running Go binary

seccomp.json5

{
  "defaultAction": "SCMP_ACT_ERRNO",
  "syscalls": [
    {
      "names": [
        // Used by Go binary.
        "arch_prctl",
        "clone",
        "close",
        "execve",
        "exit_group",
        "fcntl",
        "futex",
        "gettid",
        "mmap",
        "openat",
        "read",
        "rt_sigaction",
        "rt_sigprocmask",
        "sched_getaffinity",
        "sigaltstack",
        "write",

        // All below are required by runc to create a container.
        "fstatfs",
        "getdents64",

        "capget",
        "capset",
        "prctl",

        "fstat",
        "newfstatat",
        "setgroups",
        "setgid",
        "setuid",

        "chdir",

        "getppid"
      ],
      "action": "SCMP_ACT_ALLOW"
    }
  ]
}