PostgreSQL considers seccomp() filters

This is generally a good idea - but I find the fixed-state model of containers, that works well for well-designed useful, but simple (in a good way) services inflicts a lot of pain when you apply it to a service whose main point is to manipulate complex state in complex ways.