#pragma once

namespace doos {

// Confinement applied to every process that runs a container command, right before exec:
//   1. capability bounding set reduced to the Docker default set (spec::kKeptCaps),
//   2. a seccomp-bpf denylist (keyring, bpf, perf, userfaultfd, io_uring, mount family, kexec, module loading,
//      nested user namespaces and the like), with an architecture check and x32 guard.
// Both need no_new_privs, which the caller sets. Throws when the filter cannot be installed.
class Hardening {
public:
    static void apply();
};

}  // namespace doos