Try this method of using an OCI runtime hook for tracing syscalls before you build a container.

Source: LXer – Improving Linux container security with seccomp