# Docker SECCOMP prevents system calls issued by OCI runtime

**URL:** <https://forums.mobyproject.org/t/docker-seccomp-prevents-system-calls-issued-by-oci-runtime/297>\
**Category:** Architecture\
**Tags:** quality\
**Created:** [April 28, 2018, 9:52am UTC](https://forums.mobyproject.org/t/docker-seccomp-prevents-system-calls-issued-by-oci-runtime/297 "2018-04-28T09:52:32Z")\
**Posts on this page:** 1\
**Showing post:** 9

<div class="post-metadata">

**Author:** ![cpuguy83](https://yyz1.discourse-cdn.com/flex031/user_avatar/forums.mobyproject.org/cpuguy83/32/22_2.png) [@cpuguy83](https://forums.mobyproject.org/u/cpuguy83)\
**Post date:** [April 29, 2018, 11:47am UTC](https://forums.mobyproject.org/t/docker-seccomp-prevents-system-calls-issued-by-oci-runtime/297/9 "2018-04-29T11:47:27Z")

</div>

seccomp is enforced in runc.

The call chain looks like this: dockerd -\> containerd -\> containerd-shim -\> runc

You can’t apply a seccomp profile that would prevent runc from being able to run your process.

---

_[View the full topic](https://forums.mobyproject.org/t/docker-seccomp-prevents-system-calls-issued-by-oci-runtime/297)._