# Seitan: Syscall Expressive Interpreter, Transformer and Notifier

> Source: <https://seitan.rocks/seitan/about/>
> Published: 2026-11-04 10:23:04+00:00

## [*seitan* was at](#seitan-was-at-devconfcz-2023-check-out-the-slides-and-the-recording) [DevConf.CZ 2023](https://devconfcz2023.sched.com/event/1MYkc/seitan-a-plant-based-recipe-against-syscall-anxiety)! Check out the [slides](https://seitan.rocks/static/seitan_devconf_2023.pdf) and the [recording](https://seitan.rocks/static/seitan_devconf_2023.webm)

*seitan*was at

## 
*seitan* is a framework to filter, transform and impersonate system calls,
enabling privilege reduction in container and virtualisation engines

It allows you to filter and replay only the system calls you need, instead of
running things as root, or granting capabilities to processes.
- 

```
seitan-cooker
```

 builds a BPF program and a bytecode file (*gluten* ) from a recipe with matches on system calls and
  corresponding actions
- 

```
seitan-eater
```

 loads the BPF program associated to the process context into the kernel, and runs the target process. Container engines such as Podman can directly load this program via OCI annotations instead
- 

```
seitan
```

 is the supervisor, getting notifications via

```
seccomp_unotify
```

 , interpreting them according to*gluten* , and triggering the configured
  actions as a result

##### Note that this project and its documentation still have some rough edges! No versions, no packages yet.

#### Do you want to know more?

Watch the
[demos](#demo-handle-and-impersonate-connect-of-a-target-process-in-several-ways)below, ask your questions on the users'

[list](https://lists.seitan.rocks/postorius/lists/seitan-user.seitan.rocks/),

[chat](https://matrix.to/#/#seitan:libera.chat)with us.

#### Do you want to contribute?

Send patches to the development
[list](https://lists.seitan.rocks/postorius/lists/seitan-dev.seitan.rocks/)...

**and**
[chat](https://matrix.to/#/#seitan:libera.chat)with us!

## [Demo: handle and impersonate `connect()` of a target process in several ways](#demo-handle-and-impersonate-connect-of-a-target-process-in-several-ways)

`connect()` of a target process in several ways
## [Demo: issue `mknod()` on behalf of a Podman container](#demo-issue-mknod-on-behalf-of-a-podman-container)

`mknod()` on behalf of a Podman container