Add seccomp support

[sboeuf]

In order to enable support for seccomp inside the VM, here is what we need:

• Build the agent binary with the extra flag -tags "seccomp", this needs to be added to the Makefile. For more details, look at https://github.com/opencontainers/runc/blob/master/libcontainer/seccomp/seccomp_unsupported.go#L1 vs https://github.com/opencontainers/runc/blob/master/libcontainer/seccomp/seccomp_linux.go#L1. Indeed, we need linux, cgo and seccomp to build the right file.

• Ensure the image used on the guest does include libseccomp, otherwise we will end up with boot failure on the guest like this:

/usr/bin/cc-agent: error while loading shared libraries: libseccomp.so.2: cannot open shared object file: No such file or directory

[harche]

Anyone working on this? I can take it up if no one has already.

[sboeuf]

@harche well the thing about this issue is that we need to make a decision about the image, because the image has to support it. This discussion has to happen here I think.

[harche]

@sboeuf But this issue, kata-containers/osbuilder#28 says otherwise?

[sboeuf]

The first bullet point, that is build the agent with specific flags has to happen here on the agent repo, but the second point about having libseccomp part of the image will have to be handled from the image repo.

[nitkon]

@sboeuf @egernst @jodh-intel : Hello Team, I am planning to take up seccomp support in Kata Containers. Any background discussions I need to know before I start on it. Any ideas? Thanks! :-)

[WeiZhang555]

I think this thread is all you need to know 😄
Any PR is welcome, thank you! @nitkon