Apply a compiled seccomp-BPF syscall filter to a bwrap sandbox with --seccomp and --add-seccomp-fd

Documented steps

1. Requirements / auth: No credentials. Requires bubblewrap, unprivileged user namespaces, and a toolchain able to compile a cBPF seccomp filter (libseccomp).
2. Generate the filter outside bwrap — bwrap does not compile policies. Use libseccomp (e.g. Python `seccomp` bindings or a small C program) to build a filter and export it with `seccomp_export_bpf()`; the rules must be in the form of a compiled cBPF program.
3. Write the compiled cBPF blob to a file and open it as a file descriptor for bwrap, for example in bash: `exec 9< /path/to/filter.bpf`.
4. Pass the descriptor with `--seccomp 9`. bwrap loads and uses the seccomp rules from that FD.
5. To layer several policies (a base policy plus a workload-specific one), use `--add-seccomp-fd FD` instead — it can be repeated, and the filters are evaluated in reverse order.
6. Include a TIOCSTI ioctl denial in your filter if you are not using `--new-session`; upstream documents that without TIOCSTI filtering, `--new-session` is required to stop the sandbox injecting commands into the controlling terminal (CVE-2017-5226).
7. Test the filter with a deliberately blocked syscall before shipping it, and confirm the failure mode you configured (EPERM vs SIGSYS) is the one your caller can distinguish.
8. Official documentation: https://manpages.debian.org/unstable/bubblewrap/bwrap.1.en.html | https://github.com/containers/bubblewrap/blob/main/README.md