Maybe I'm not getting something here, but I find the pledge/unveil approach confusing.

Why should I expect a program to set allowed syscalls/filesystem paths? Why would I trust that it will set itself the right permissions? What is allowed should be set externally from the program, similarly how I can map filesystem volumes and add capabilities to a Docker container [1].

I'm not familiar with BSD and I only used it a couple times out of curiosity. What am I missing?

[1] https://docs.docker.com/engine/security/#linux-kernel-capabi...