Assertion: lepton | /r/CapableOf | run within seccomp
Facets:
value: to disable all system calls
type: PURPOSE
value: as an added security layer
type: PURPOSE
Source sentences:
text: As an added security layer, Lepton runs within seccomp to disable all system calls except read and write of already-open file descriptors.