{"slug": "seitan-syscall-expressive-interpreter-transformer-and-notifier", "title": "Seitan: Syscall Expressive Interpreter, Transformer and Notifier", "summary": "The seitan project released a framework that filters, transforms and impersonates system calls to reduce privileges in container and virtualisation engines, letting operators replay only the system calls they need instead of running processes as root or granting capabilities. The framework comprises seitan-cooker, which builds a BPF program and a bytecode file called gluten from a recipe of system-call matches and actions; seitan-eater, which loads the BPF program into the kernel and runs the target process, loadable by container engines such as Podman via OCI annotations; and seitan, the supervisor that receives notifications via seccomp_unotify, interprets them per gluten and triggers configured actions. The project's documentation notes it still has rough edges, with no versions or packages yet, and it was presented at DevConf.CZ 2023.", "body_md": "## [*seitan* was at](#seitan-was-at-devconfcz-2023-check-out-the-slides-and-the-recording) [DevConf.CZ 2023](https://devconfcz2023.sched.com/event/1MYkc/seitan-a-plant-based-recipe-against-syscall-anxiety)! Check out the [slides](https://seitan.rocks/static/seitan_devconf_2023.pdf) and the [recording](https://seitan.rocks/static/seitan_devconf_2023.webm)\n\n*seitan*was at\n\n## \n*seitan* is a framework to filter, transform and impersonate system calls,\nenabling privilege reduction in container and virtualisation engines\n\nIt allows you to filter and replay only the system calls you need, instead of\nrunning things as root, or granting capabilities to processes.\n- \n\n```\nseitan-cooker\n```\n\n builds a BPF program and a bytecode file (*gluten* ) from a recipe with matches on system calls and\n  corresponding actions\n- \n\n```\nseitan-eater\n```\n\n loads the BPF program associated to the process context into the kernel, and runs the target process. Container engines such as Podman can directly load this program via OCI annotations instead\n- \n\n```\nseitan\n```\n\n is the supervisor, getting notifications via\n\n```\nseccomp_unotify\n```\n\n , interpreting them according to*gluten* , and triggering the configured\n  actions as a result\n\n##### Note that this project and its documentation still have some rough edges! No versions, no packages yet.\n\n#### Do you want to know more?\n\nWatch the\n[demos](#demo-handle-and-impersonate-connect-of-a-target-process-in-several-ways)below, ask your questions on the users'\n\n[list](https://lists.seitan.rocks/postorius/lists/seitan-user.seitan.rocks/),\n\n[chat](https://matrix.to/#/#seitan:libera.chat)with us.\n\n#### Do you want to contribute?\n\nSend patches to the development\n[list](https://lists.seitan.rocks/postorius/lists/seitan-dev.seitan.rocks/)...\n\n**and**\n[chat](https://matrix.to/#/#seitan:libera.chat)with us!\n\n## [Demo: handle and impersonate `connect()` of a target process in several ways](#demo-handle-and-impersonate-connect-of-a-target-process-in-several-ways)\n\n`connect()` of a target process in several ways\n## [Demo: issue `mknod()` on behalf of a Podman container](#demo-issue-mknod-on-behalf-of-a-podman-container)\n\n`mknod()` on behalf of a Podman container", "url": "https://wpnews.pro/news/seitan-syscall-expressive-interpreter-transformer-and-notifier", "canonical_source": "https://seitan.rocks/seitan/about/", "published_at": "2026-11-04 10:23:04+00:00", "updated_at": "2026-11-04 10:50:45.786792+00:00", "lang": "en", "topics": ["developer-tools", "ai-infrastructure"], "entities": ["seitan", "seitan-cooker", "seitan-eater", "gluten", "Podman", "DevConf.CZ 2023", "seccomp_unotify"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/seitan-syscall-expressive-interpreter-transformer-and-notifier", "markdown": "https://wpnews.pro/news/seitan-syscall-expressive-interpreter-transformer-and-notifier.md", "text": "https://wpnews.pro/news/seitan-syscall-expressive-interpreter-transformer-and-notifier.txt", "jsonld": "https://wpnews.pro/news/seitan-syscall-expressive-interpreter-transformer-and-notifier.jsonld"}}