# Using the Seccomp Notifier to Intercept bpf() in Unprivileged Containers

DevFeed: [Using the Seccomp Notifier to Intercept bpf() in Unprivileged Containers](<https://devfeed.tech/articles/the-seccomp-notifier-cranking-up-the-crazy-with-bpf-33952.md>)

Original publisher: [Read original article](<https://brauner.io/2020/08/07/seccomp-notify-intercepting-the-bpf-syscall.html>)

Author: Christian Brauner

Published: 2020-08-06T22:00:00Z

Content type: tutorial

Language: en

Sources: [Personal blog of Christian Brauner](<https://devfeed.tech/sources/personal-blog-of-christian-brauner.md>)

Topics: [Containers](<https://devfeed.tech/topics/containers.md>), [Kernel](<https://devfeed.tech/topics/kernel.md>)

Tags: [containers](<https://devfeed.tech/tags/containers.md>), [demo](<https://devfeed.tech/tags/demo.md>), [kernel](<https://devfeed.tech/tags/kernel.md>), [pull-request](<https://devfeed.tech/tags/pull-request.md>)

## AI overview

This short sequel demonstrates how seccomp notifier features can intercept syscalls involving file descriptors. It shows LXD supervising syscalls in unprivileged containers so a nested unprivileged container can load its own device profile in the cgroup2 hierarchy.

## Source excerpt

In my last article I looked at the seccomp notifier in detail and how it allows us to make unprivileged containers way more capable (Sorry, kernel joke.). This is the (very) crazy (but very short) sequel. (Sorry Jon, no novella this time. :))