Hi everyone,

I'm working on setting up NanoClaw in a production-like environment on my home lab (using Docker on Debian 12). I'm following the hardening guides, and I've been trying to apply a restrictive seccomp profile. I'm using the default Docker one for `runtime/default` with most syscalls dropped, just like the docs suggest for maximum isolation.

The problem is, after applying the stricter profile, my nanoclaw container fails to start properly. The logs show permission errors that look like syscalls are being blocked. The container starts, but the agent inside seems to hang and doesn't respond to tasks.

I suspect some required syscalls for the underlying tooling (maybe for the capability system or network sandboxing) are missing from my allowed list. Has anyone else run into this?

Could someone point me to a known-working seccomp profile for a production NanoClaw deployment? Or maybe list which syscalls are absolutely essential? I'm not sure where the line is between being secure and breaking functionality.

Here's the security section of my docker-compose file I'm testing with:

```yaml
security_opt:
- seccomp=./seccomp-profile.json
- no-new-privileges:true
cap_drop:
- ALL
cap_add:
- CHOWN
- SETUID
- SETGID
- NET_BIND_SERVICE
read_only: true
```

My `seccomp-profile.json` is basically the Docker default with a few extra syscalls I guessed might be needed, like `futex`, `epoll_wait`, and `eventfd2`. But I'm clearly still missing something.

Any guidance on how to debug this systematically would be super helpful. Should I be running strace inside the container, or is there a better way?

thanks - Jay