This is obvious, but it surprised me so I'll mention it to add to the general background understanding. seccomp has to allow not just what our code does directly, but also what the libraries do. DNS lookup in libc does all sorts of things. So does libssl. -- These are my opinions. I hate spam.