Stop privilege escalation before it starts. A senior engineer explains how to use Seccomp and Linux Capabilities to shrink your kernel attack surface based on real-world incident response.