instruction: Create a Dockerfile for security
output: ```dockerfile
  from using the kernel keyring, which is not namespaced.set_mempolicySyscall that modifies kernel memory and NUMA settings. Already gated by CAP_SYS_NICE.setnsDeny associating a thread with a namespace. Also gated by CAP_SYS_ADMIN.settimeofdayTime/date is not namespaced. Also gated by CAP_SYS_TIME.stimeTime/date is not namespaced. Also gated by CAP_SYS_TIME.swaponDeny start/stop swapping to file/device. Also gated by CAP_SYS_ADMIN.swapoffDeny start/stop swapping to file/device. Also gated by CAP_SYS_ADMIN.sysfsObsolete syscall._sysctlObsolete, replaced by /proc/sys.umountShould be a privileged operation. Also gated by CAP_SYS_ADMIN.umount2Should be a privileged operation. Also gated by CAP_SYS_ADMIN.unshareDeny cloning new namespaces for processes. Also gated by CAP_SYS_ADMIN, with the exception of unshare --user.uselibOlder syscall related to shared libraries, unused for a long time.userfaultfdUserspace page fault handling, largely needed for process migration.ustatObsolete syscall.vm86In kernel x86 real mode virtual machine. Also gated by CAP_SYS_ADMIN.vm86oldIn kernel x86 real mode virtual machine. Also gated by CAP_SYS_ADMIN.Run without the default seccomp profileYou can pass unconfined to run a container without the default seccomp
  profile.
  
  $ docker run --rm -it --security-opt seccomp=unconfined debian:latest \
   unshare --map-root-user --user sh -c whoami
  
  Request changesTable of contentsPass a profile for a containerSignificant syscalls blocked by the default profileRun without the default seccomp profile
  
  Product offerings
  Pricing
  About us
  Contribute
  Read llms.txt
  Cookies Settings
  
  Status
  Legal```