alt Hacker NewsYou mentioned SECCOMP_RET_TRACE, but there is also SECCOMP_RET_TRAP[1] which appears to perform better. There is also KVM. Both of these are options for gVisor: <https://github.com/google/gvisor>
[1] <https://github.com/google/gvisor/blob/master/pkg/sentry/plat...>
There's also SECCOMP_RET_USER_NOTIF, which is typically used by container runtimes for their sandboxing.