seccomp
Linux mechanism for whitelisting which syscalls a process is allowed to make — anything off the list kills the process (or returns EPERM).
The modern form, seccomp-bpf (2012), lets you write a BPF filter that inspects syscall numbers and arguments. Docker, Kubernetes, Chromium, systemd and Firefox all run with seccomp profiles by default — Docker's default profile blocks about 40 of ~330 syscalls (mount, kexec, reboot, ptrace, etc.).
Solid defense-in-depth against kernel exploits: even if an attacker RCEs your process, they can't reach syscalls not on the whitelist. Pair with capability-based privilege control and user namespaces.