Will this Linux kernel facility limit a Docker container's access to host resources, such as CPU or memory? Solution: seccomp

Seccomp focuses on system call filtering for security, not resource allocation or limits like CPU and memory.

Seccomp (Secure Computing mode) is a Linux kernel facility that restricts the system calls a process can make, thereby limiting its attack surface. It does not control host resources such as CPU, memory, or I/O, which are managed by cgroups.