There’s not really much way around this since Linux puts syscall traps in every binary rather than routing through a libsyscall.so that contains the traps. (If the latter were the case, a container could provide an alternate library to do syscall interception much more easily on non-Linux platforms.)