Seeing seccomp filters break subprocess spawning in containerized workloads. Specifically clone() being blocked.

Common pattern:

```json
{
"names": ["clone"],
"action": "SCMP_ACT_ERRNO",
"args": [],
"comment": "restrict process creation"
}
```

Problem: Many languages/runtimes (Go, Python subprocess) rely on clone() for fork/exec. Blocking it outright kills legitimate process management.

What are you actually trying to block?
- New network namespace? Filter on `CLONE_NEWNET`.
- General process isolation? Might need to allow clone but restrict with cgroups pids controller.
- True fork bombs? Limit via RLIMIT_NPROC.

Better approach: Allow clone, but filter on its flags argument.

```json
{
"names": ["clone"],
"action": "SCMP_ACT_ALLOW",
"args": [
{
"index": 0,
"value": 2114060288, // CLONE_NEWUSER | CLONE_NEWNS | CLONE_NEWPID | CLONE_NEWNET ...
"valueTwo": 0,
"op": "SCMP_CMP_MASKED_EQ"
}
],
"comment": "deny clone with namespace flags"
}
```

What's your actual filter? What's the workload? Are you blocking clone entirely or using argument filtering?