Speedup build container data access via system call filtering

1. A method comprising:

receiving a system call from an application within a container executing on an operating system, the system call comprising a synchronization operation to synchronize memory of the application to storage;

determining, by processing device executing an operating system kernel, whether a system call filtering policy associated with the container indicates that the system call is to be prevented; and

preventing, by the processing device executing the kernel, performance of the synchronization operation in view of the system call filtering policy.

2. The method of claim 1 , wherein the system call filtering policy comprises a secure computing mode policy.

3. The method of claim 1 , further comprising:

providing a response to the application indicating that the system call has been performed.

4. The method of claim 3 , wherein the response provided to the application indicating that the system call has been performed comprises an indication that the synchronization operation has been successfully performed.

5. The method of claim 1 , wherein determining whether the system call filtering policy indicates that the system call is to be prevented comprises:

identifying the system call filtering policy associated with the container;

determining at least one system call to be filtered by the system call filtering policy; and

determining whether the at least one system call to be filtered includes the system call received from the application.

6. The method of claim 1 , wherein the system call filtering policy associated with the container prevents performance of synchronization operations received from the container during a build of the container.

7. The method of claim 6 , further comprising:

determining that the build of the container has completed; and

synchronizing the completed build of the container to storage.

8. A system comprising:

a memory; and

a processing device operatively coupled to the memory, the processing device to:

receive, at a kernel of an operating system executing on the processing device, a system call from an application within a container executing on the operating system, the system call comprising a synchronization operation to synchronize memory of the application to storage;

determine, by the kernel, whether a system call filtering policy associated with the container indicates that the system call is to be prevented; and

prevent performance of the synchronization operation in view of the system call filtering policy.

9. The system of claim 8 , wherein the system call filtering policy comprises a secure computing mode policy.

10. The system of claim 8 , wherein the processing device is further to:

provide a response to the application indicating that the system call has been performed.

11. The system of claim 10 , wherein the response provided to the application indicating that the system call has been performed comprises an indication that the synchronization operation has been successfully performed.

12. The system of claim 8 , wherein to determine whether the system call filtering policy indicates that the system call is to be prevented, the processing device is to:

identify the system call filtering policy associated with the container;

determine at least one system call to be filtered by the system call filtering policy; and

determine whether the at least one system call to be filtered includes the system call received from the application.

13. The system of claim 8 , wherein the system call filtering policy associated with the container prevents performance of synchronization operations received from the container during a build of the container.

14. The system of claim 13 , wherein the processing device is further to:

determine that the build of the container has completed; and

synchronize the completed build of the container to storage.

15. A non-transitory computer-readable storage medium including instructions that, when executed by a processing device, cause the processing device to:

receive a system call from an application within a container executing on an operating system, the system call comprising a synchronization operation to synchronize memory of the application to storage;

determine, by the processing device executing an operating system kernel, whether a system call filtering policy associated with the container indicates that the system call is to be prevented; and

prevent, by the processing device, performance of the synchronization operation in view of the system call filtering policy.

16. The non-transitory computer-readable storage medium of claim 15 , wherein the system call filtering policy comprises a secure computing mode policy.

17. The non-transitory computer-readable storage medium of claim 15 , wherein the processing device is further to:

provide a response to the application indicating that the system call has been performed.

18. The non-transitory computer-readable storage medium of claim 15 , wherein to determine whether the system call filtering policy indicates that the system call is to be prevented, the processing device is to:

identify the system call filtering policy associated with the container;

determine at least one system call to be filtered by the system call filtering policy; and

determine whether the at least one system call to be filtered includes the system call received from the application.

19. The non-transitory computer-readable storage medium of claim 15 , wherein the system call filtering policy associated with the container prevents performance of synchronization operations received from the container during a build of the container.

20. The non-transitory computer-readable storage medium of claim 19 , wherein the processing device is further to:

determine that the build of the container has completed; and

synchronize the completed build of the container to storage.