Docker Capabilities & Seccomp The main tests use the Goss project. Auditing Sysdig Falco is used to monitor the containers. Sysdig Falco is an auditing tool as opposed to enforcement tools like Seccomp or AppArmor. Ressources Docker Capabilities Explain Falco Workshop