Seccomp BPF is great. There was some recent issues due to IO_uring and extensible syscalls, but I believe for now, those issues are avoidable.

I believe the next generation looks something like landlock (https://docs.kernel.org/userspace-api/landlock.html).