Sandboxing, seccomp, and Memory-Safe Languages

• Sandboxing / seccomp: even after code execution, restrict what the process may do. seccomp-bpf whitelists syscalls; a shell/execve attempt is killed. Containment, not prevention.
• Privilege separation: drop privileges, isolate components, limit blast radius.
• The strategic fix -- memory safety: languages like Rust (and Go, managed runtimes) eliminate the underlying bug class — no OOB, no use-after-free, no double-free by construction.
• Mitigations raise the cost of exploiting C/C++ bugs; memory-safe languages remove most of those bugs entirely.