Rewriting Every Syscall in a Linux Binary at Load Time

The article proposes rewriting syscall instructions (0F 05 opcode) at binary load time to redirect to a custom handler implementing only the ~40 syscalls a process actually needs, rather than exposing the full 450+ Linux syscall surface to untrusted container code. This avoids the limitations of existing approaches like compiler integration, LD_PRELOAD, unikernels, and seccomp-bpf filters. The technique works below the language and compiler level, catching all syscall paths.