A new template that allows for complain mode, whilst still blocking high-risk calls.

The command line options could be improved to reduce the amount of keywords that are needed. Example:

$ zaz seccomp docker alpine "echo hi"
$ zaz seccomp kube -f pod.yaml
$ zaz seccomp goapp/myexe
$ zaz seccomp --log-file=/var/log/syslog 423

For seccomp generation from executables, try to infer type (i.e. golang, dotnet, elf, etc.) so no new keywords are needed.

zaz always returns a fresh new profile. It would be handy for automatic profile generation to return the existing profile merged with the new syscalls found.

This behaviour could be enabled by using a new flag.

The current implementation has a hard-coded list of high-risk calls.
Users using the feature to validate profiles on automated processes, may benefit from being able to define what calls are defined as high-risk for their workloads.

Using SCMP_ACT_KILL_PROCESS for brute-force may generate better results, as it would make it harder for the application to "fail silently".

This depends on: opencontainers/runtime-spec#1044

An option to execute brute-force attempts in parallel could be added to decrease execution time.