diff --git a/Dockerfile b/Dockerfile
index 43059f2..9bb1f62 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -47,6 +47,7 @@ set -e
 apt update
 apt upgrade -y
 apt install -y --no-install-recommends \
+    lua5.4 \
     build-essential \
     ca-certificates \
     wget
@@ -57,6 +58,7 @@ WORKDIR /opt/build
 # install bubblewrap (for sanboxing)
 ARG BUBBLEWRAP_VER=0.8.0
 RUN <<EOF
+set -eu
 apt-get install -y libseccomp-dev libcap-dev
 wget -O bubblewrap-${BUBBLEWRAP_VER}.tar.xz https://github.com/containers/bubblewrap/releases/download/v${BUBBLEWRAP_VER}/bubblewrap-${BUBBLEWRAP_VER}.tar.xz
 tar xf bubblewrap-${BUBBLEWRAP_VER}.tar.xz
@@ -67,12 +69,16 @@ make LDFLAGS=-static
 EOF
 
 # install bwrapbox (for sanboxing)
-ARG BWRAPBOX_VER=0.2.1
+ARG BWRAPBOX_VER=0.2.2
+COPY --chmod=466 bwrapbox/generate-rules.lua /tmp
 RUN <<EOF
+set -eu
 wget -O bwrapbox-${BWRAPBOX_VER}.tar.gz https://github.com/edubart/bwrapbox/archive/refs/tags/v${BWRAPBOX_VER}.tar.gz
 tar xf bwrapbox-${BWRAPBOX_VER}.tar.gz
 mv bwrapbox-${BWRAPBOX_VER} bwrapbox
 cd bwrapbox
+cp /tmp/generate-rules.lua .
+make generate-seccomp-rules seccomp-filter.bpf
 make LDFLAGS=-static
 EOF
 
@@ -88,7 +94,7 @@ ARG MACHINE_EMULATOR_TOOLS_VERSION=0.14.1
 ARG MACHINE_EMULATOR_TOOLS_DEB=machine-emulator-tools-v${MACHINE_EMULATOR_TOOLS_VERSION}.deb
 ARG DEBIAN_FRONTEND=noninteractive
 RUN <<EOF
-set -e
+set -eu
 apt-get update
 apt-get upgrade -y
 apt-get install -y --no-install-recommends \
@@ -118,7 +124,7 @@ WORKDIR /opt/cartesi/dapp
 COPY --from=build-stage /opt/build/dapp .
 COPY --chmod=755 skel/cartesi-init /usr/sbin/cartesi-init
 COPY --chmod=755 skel/bounty-run /usr/bin/bounty-run
-COPY --chmod=644 tests/bounties/**/*.tar.xz /bounties/examples
+COPY --chmod=644 tests/bounties/**/*-bounty_riscv64.tar.xz /bounties/examples
 
 ENTRYPOINT ["rollup-init"]
 CMD ["/opt/cartesi/dapp/dapp"]
diff --git a/bwrapbox/generate-rules.lua b/bwrapbox/generate-rules.lua
new file mode 100644
index 0000000..f016607
--- /dev/null
+++ b/bwrapbox/generate-rules.lua
@@ -0,0 +1,597 @@
+local allowed_syscalls = {
+  -- basic IO
+  '_llseek',
+  'close',
+  'close_range',
+  'lseek',
+  'pread64',
+  'preadv',
+  'preadv2',
+  'pwrite64',
+  'pwritev',
+  'pwritev2',
+  'read',
+  'readv',
+  'write',
+  'writev',
+
+  -- signal handling
+  'rt_sigaction',
+  'rt_sigpending',
+  'rt_sigprocmask',
+  'rt_sigqueueinfo',
+  'rt_sigreturn',
+  'rt_sigsuspend',
+  'rt_sigtimedwait',
+  'rt_sigtimedwait_time64',
+  'rt_tgsigqueueinfo',
+  'sigaction',
+  'sigaltstack',
+  'signal',
+  'signalfd',
+  'signalfd4',
+  'sigpending',
+  'sigprocmask',
+  'sigreturn',
+  'sigsuspend',
+
+  -- filesystem
+  'access',
+  'faccessat',
+  'faccessat2',
+  'chdir',
+  'fchdir',
+  'chmod',
+  'fchmod',
+  'fchmodat',
+  'link',
+  'linkat',
+  'readlink',
+  'readlinkat',
+  'symlink',
+  'symlinkat',
+  'unlink',
+  'unlinkat',
+  'rmdir',
+  'rename',
+  'renameat',
+  'renameat2',
+  'fcntl',
+  'fcntl64',
+  'fstat',
+  'fstat64',
+  'fstatat64',
+  'fstatfs',
+  'fstatfs64',
+  'lstat',
+  'lstat64',
+  'newfstatat',
+  'oldfstat',
+  'oldlstat',
+  'oldstat',
+  'stat',
+  'stat64',
+  'statfs',
+  'statfs64',
+  'statx',
+  'ftruncate',
+  'ftruncate64',
+  'truncate',
+  'truncate64',
+  'futimesat',
+  'utime',
+  'utimensat',
+  'utimensat_time64',
+  'utimes',
+  'fallocate',
+  'getcwd',
+  'getdents',
+  'getdents64',
+  'mkdir',
+  'mkdirat',
+  'mknod',
+  'mknodat',
+  'umask',
+
+  -- fd creation
+  'creat',
+  'open',
+  'openat',
+  'openat2',
+  'dup',
+  'dup2',
+  'dup3',
+  'open_by_handle_at',
+  'name_to_handle_at',
+
+  -- piping
+  'copy_file_range',
+  'pipe',
+  'pipe2',
+  'sendfile',
+  'sendfile64',
+  'splice',
+  'tee',
+  'vmsplice',
+
+  -- sync
+  'fdatasync',
+  'fsync',
+  'msync',
+  'sync',
+  'sync_file_range',
+  'sync_file_range2',
+  'syncfs',
+
+  -- process spawning
+  'brk',
+  'clone',
+  'clone3',
+  'execve',
+  'execveat',
+  'fork',
+  'vfork',
+
+  -- process termination
+  'kill',
+  'exit',
+  'exit_group',
+
+  -- current state information
+  'getegid',
+  'getegid32',
+  'geteuid',
+  'geteuid32',
+  'getgid',
+  'getgid32',
+  'getgroups',
+  'getgroups32',
+  'getpgid',
+  'getpgrp',
+  'getpid',
+  'getppid',
+  'getrandom',
+  'getresgid',
+  'getresgid32',
+  'getresuid',
+  'getresuid32',
+  'getsid',
+  'gettid',
+  'getuid',
+  'getuid32',
+
+  -- threads
+  'get_thread_area',
+  'set_thread_area',
+  'set_tid_address',
+  'tgkill',
+  'tkill',
+
+  -- allow getting time
+  'clock_getres',
+  'clock_getres_time64',
+  'clock_gettime',
+  'clock_gettime64',
+  'gettimeofday',
+  'time',
+  'times',
+
+  -- process suspension
+  'clock_nanosleep',
+  'clock_nanosleep_time64',
+  'nanosleep',
+  'pause',
+  'wait4',
+  'waitid',
+  'waitpid',
+  'sched_yield',
+
+  -- virtual memory mapping
+  'membarrier',
+  'mmap',
+  'mmap2',
+  'mprotect',
+  'munmap',
+
+  -- RISC-V only
+  'riscv_flush_icache',
+
+  -- event loop
+  '_newselect',
+  'eventfd',
+  'eventfd2',
+  'ioctl',
+  'poll',
+  'ppoll',
+  'ppoll_time64',
+  'pselect6',
+  'pselect6_time64',
+  'select',
+
+  -- other
+  'arch_prctl',
+  'cacheflush',
+  'rseq',
+
+  -- system information
+  'capget',
+  'getcpu',
+  'getpriority',
+  'getrlimit',
+  'getrusage',
+  'oldolduname',
+  'olduname',
+  'sysinfo',
+  'ugetrlimit',
+  'uname',
+
+  --- futex
+  'futex',
+}
+
+local disallowed_syscalls = {
+  -- epoll
+  'epoll_create',
+  'epoll_create1',
+  'epoll_ctl',
+  'epoll_ctl_old',
+  'epoll_pwait',
+  'epoll_pwait2',
+  'epoll_wait',
+  'epoll_wait_old',
+
+  -- filesystem xattr
+  'fgetxattr',
+  'flistxattr',
+  'fremovexattr',
+  'fsetxattr',
+  'getxattr',
+  'lgetxattr',
+  'listxattr',
+  'llistxattr',
+  'lremovexattr',
+  'lsetxattr',
+  'removexattr',
+  'setxattr',
+
+  --- futex
+  'get_robust_list',
+  'set_robust_list',
+  'futex_time64',
+  'futex_waitv',
+
+  -- inter process communication
+  'ipc',
+  'memfd_create',
+  'memfd_secret',
+  'mq_getsetattr',
+  'mq_notify',
+  'mq_open',
+  'mq_timedreceive',
+  'mq_timedreceive_time64',
+  'mq_timedsend',
+  'mq_timedsend_time64',
+  'mq_unlink',
+  'msgctl',
+  'msgget',
+  'msgrcv',
+  'msgsnd',
+  'pidfd_getfd',
+  'pidfd_open',
+  'pidfd_send_signal',
+  'process_madvise',
+  'process_mrelease',
+  'process_vm_readv',
+  'process_vm_writev',
+  'semctl',
+  'semget',
+  'semop',
+  'semtimedop',
+  'semtimedop_time64',
+  'shmat',
+  'shmctl',
+  'shmdt',
+  'shmget',
+
+  -- scheduler information
+  'sched_get_priority_max',
+  'sched_get_priority_min',
+  'sched_getaffinity',
+  'sched_getattr',
+  'sched_getparam',
+  'sched_getscheduler',
+  'sched_rr_get_interval',
+  'sched_rr_get_interval_time64',
+
+  -- advanced filesystem
+  'fadvise64',
+  'fadvise64_64',
+  'flock',
+  'readahead',
+  'readdir',
+
+  -- scheduler sets
+  'sched_setaffinity',
+  'sched_setattr',
+  'sched_setparam',
+  'sched_setscheduler',
+
+  -- set resources
+  'nice',
+  'ioprio_get',
+  'ioprio_set',
+  'setpriority',
+  'setrlimit',
+  'move_pages',
+  'mbind',
+  'get_mempolicy',
+  'set_mempolicy',
+  'set_mempolicy_home_node',
+  'migrate_pages',
+  'prctl',
+  'prlimit64',
+
+  -- raw io
+  'ioperm',
+  'iopl',
+  'pciconfig_iobase',
+  'pciconfig_read',
+  'pciconfig_write',
+
+  -- memory lock
+  'mlock',
+  'mlock2',
+  'mlockall',
+  'munlock',
+  'munlockall',
+
+  -- advanced memory control
+  'madvise',
+  'mremap',
+  'mincore',
+
+  -- landlock
+  'landlock_add_rule',
+  'landlock_create_ruleset',
+  'landlock_restrict_self',
+
+  -- aio
+  'io_cancel',
+  'io_destroy',
+  'io_getevents',
+  'io_pgetevents',
+  'io_pgetevents_time64',
+  'io_setup',
+  'io_submit',
+  'io_uring_enter',
+  'io_uring_register',
+  'io_uring_setup',
+
+  -- networking
+  'accept',
+  'accept4',
+  'bind',
+  'connect',
+  'getpeername',
+  'getsockname',
+  'getsockopt',
+  'listen',
+  'recv',
+  'recvfrom',
+  'recvmmsg',
+  'recvmmsg_time64',
+  'recvmsg',
+  'send',
+  'sendmmsg',
+  'sendmsg',
+  'sendto',
+  'setsockopt',
+  'shutdown',
+  'socket',
+  'socketcall',
+  'socketpair',
+
+  -- filesystem chown
+  'chown',
+  'chown32',
+  'fchown',
+  'fchown32',
+  'fchownat',
+  'lchown',
+  'lchown32',
+
+  -- memory protection keys
+  'pkey_alloc',
+  'pkey_free',
+  'pkey_mprotect',
+
+  -- swap
+  'swapoff',
+  'swapon',
+
+  -- set gid/uid
+  'setfsgid',
+  'setfsgid32',
+  'setfsuid',
+  'setfsuid32',
+  'setgid',
+  'setgid32',
+  'setgroups',
+  'setgroups32',
+  'setpgid',
+  'setregid',
+  'setregid32',
+  'setresgid',
+  'setresgid32',
+  'setresuid',
+  'setresuid32',
+  'setreuid',
+  'setreuid32',
+  'setsid',
+  'setuid',
+  'setuid32',
+
+  -- inotify
+  'fanotify_init',
+  'fanotify_mark',
+  'inotify_add_watch',
+  'inotify_init',
+  'inotify_init1',
+  'inotify_rm_watch',
+
+  -- timer
+  'alarm',
+  'getitimer',
+  'setitimer',
+  'timer_create',
+  'timer_delete',
+  'timer_getoverrun',
+  'timer_gettime',
+  'timer_gettime64',
+  'timer_settime',
+  'timer_settime64',
+  'timerfd',
+  'timerfd_create',
+  'timerfd_gettime',
+  'timerfd_gettime64',
+  'timerfd_settime',
+  'timerfd_settime64',
+
+  -- set clock
+  'adjtimex',
+  'clock_adjtime',
+  'clock_adjtime64',
+  'clock_settime',
+  'clock_settime64',
+  'settimeofday',
+
+  -- manipulating kernel modules
+  'create_module',
+  'delete_module',
+  'finit_module',
+  'init_module',
+  'query_module',
+
+  -- ARM only
+  'arm_fadvise64_64',
+  'arm_sync_file_range',
+  'breakpoint',
+  'get_tls',
+  'set_tls',
+  'usr26',
+  'usr32',
+
+  -- s390 only
+  's390_guarded_storage',
+  's390_pci_mmio_read',
+  's390_pci_mmio_write',
+  's390_runtime_instr',
+  's390_sthyi',
+
+  -- powerpc only
+  'rtas',
+  'spu_create',
+  'spu_run',
+  'subpage_prot',
+  'swapcontext',
+  'switch_endian',
+  'sys_debug_setcontext',
+
+  -- mips only
+  'cachectl',
+  'sysmips',
+
+  -- x86 only
+  'vm86',
+  'vm86old',
+
+  -- reading current quota use
+  'quotactl',
+  'quotactl_fd',
+
+  -- access to the kernel keyring
+  'add_key',
+  'keyctl',
+  'request_key',
+
+  -- sub-namespaces
+  'unshare',
+  'setns',
+  'mount',
+  'umount',
+  'umount2',
+  'pivot_root',
+  'chroot',
+
+  -- new mount manipulation APIs
+  'fsconfig',
+  'fsmount',
+  'fsopen',
+  'fspick',
+  'mount_setattr',
+  'move_mount',
+  'open_tree',
+
+  -- privileged
+  'acct',
+  'bpf',
+  'capset',
+  'kcmp',
+  'kexec_file_load',
+  'kexec_load',
+  'lookup_dcookie',
+  'modify_ldt',
+  'perf_event_open',
+  'personality',
+  'ptrace',
+  'reboot',
+  'restart_syscall',
+  'seccomp',
+  'setdomainname',
+  'sethostname',
+  'syscall',
+  'syslog',
+  'userfaultfd',
+  'vhangup',
+
+  -- obsolete syscalls
+  '_sysctl',
+  'afs_syscall',
+  'bdflush',
+  'break',
+  'ftime',
+  'get_kernel_syms',
+  'getpmsg',
+  'gtty',
+  'idle',
+  'lock',
+  'mpx',
+  'multiplexer',
+  'nfsservctl',
+  'prof',
+  'profil',
+  'putpmsg',
+  'remap_file_pages',
+  'security',
+  'sgetmask',
+  'ssetmask',
+  'stime',
+  'stty',
+  'sysfs',
+  'tuxcall',
+  'ulimit',
+  'uselib',
+  'ustat',
+  'vserver',
+}
+
+local f = assert(io.open('seccomp-filter-rules.h', 'w'))
+for _,name in ipairs(allowed_syscalls) do
+  local line = string.format("ALLOW_RULE(%s)\n", name)
+  f:write(line)
+end
+f:close()
+
+print('allowed', #allowed_syscalls)
+print('disallowed', #disallowed_syscalls)
+assert(#allowed_syscalls + #disallowed_syscalls == 481)
diff --git a/tests/bounties/Makefile b/tests/bounties/Makefile
index c8219f7..722f686 100644
--- a/tests/bounties/Makefile
+++ b/tests/bounties/Makefile
@@ -7,7 +7,7 @@ all:
 
 	$(MAKE) -C busybox-bounty riscv64 VERSION=1.36.1
 
-	$(MAKE) -C solidity-bounty riscv64 VERSION=0.8.24
+	$(MAKE) -C solidity-bounty riscv64 VERSION=0.8.26
 
 clean:
 	$(MAKE) -C lua-bounty clean
diff --git a/tests/bounties/solidity-bounty/Dockerfile b/tests/bounties/solidity-bounty/Dockerfile
index 3e12c3d..309adc5 100644
--- a/tests/bounties/solidity-bounty/Dockerfile
+++ b/tests/bounties/solidity-bounty/Dockerfile
@@ -1,10 +1,61 @@
-FROM --platform=linux/riscv64 riscv64/ubuntu:22.04
+FROM ubuntu:22.04 as base-builder
 RUN apt-get update && apt-get upgrade -y
-RUN apt-get install -y --no-install-recommends ca-certificates build-essential wget xz-utils
-RUN apt-get install -y --no-install-recommends cmake libboost-all-dev libcln-dev libcvc4-dev
-WORKDIR /root
-COPY Makefile .
-COPY --chmod=755 start.sh .
+RUN apt-get install -y --no-install-recommends \
+    build-essential \
+    ca-certificates \
+    crossbuild-essential-riscv64 \
+    git \
+    make \
+    wget \
+    xz-utils
+
+#
+# Build Boost
+#
+
+FROM base-builder as boost-builder
+WORKDIR /opt/build
+RUN wget "https://boostorg.jfrog.io/artifactory/main/release/1.74.0/source/boost_1_74_0.tar.gz"
+RUN tar xzf boost_1_74_0.tar.gz
+WORKDIR /opt/build/boost_1_74_0
+RUN mkdir -p /opt/boost
+RUN ./bootstrap.sh --prefix=/opt/boost
+RUN echo "using gcc : riscv64 : riscv64-linux-gnu-g++ ;" > "${HOME}/user-config.jam"
+RUN ./b2 toolset=gcc-riscv64 headers
+RUN ./b2 toolset=gcc-riscv64 link=static variant=release runtime-link=static \
+    --with-system --with-filesystem --with-test --with-program_options \
+    install -j `nproc`
+
+#
+# Build Solidity
+#
+
+FROM base-builder as solidity-builder
+WORKDIR /opt/build
+RUN apt-get install -y --no-install-recommends cmake
 ARG VERSION
-RUN make download VERSION=${VERSION}
-RUN make VERSION=${VERSION}
+RUN wget -O solidity-${VERSION}.tar.gz https://github.com/ethereum/solidity/releases/download/v${VERSION}/solidity_${VERSION}.tar.gz
+RUN tar xzf solidity-${VERSION}.tar.gz
+COPY --from=boost-builder /opt/boost /opt/boost
+RUN cmake \
+    -S solidity_${VERSION} \
+    -B solidity_${VERSION}/build \
+    -DCMAKE_BUILD_TYPE=Release \
+    -DCMAKE_SYSTEM_NAME=Linux \
+    -DCMAKE_C_COMPILER=riscv64-linux-gnu-gcc \
+    -DCMAKE_CXX_COMPILER=riscv64-linux-gnu-g++ \
+    -DBoost_INCLUDE_DIR=/opt/boost \
+    -DBoost_USE_STATIC_RUNTIME=ON \
+    -DUSE_CVC4=OFF \
+    -DUSE_Z3=OFF \
+    -DTESTS=OFF
+
+RUN make -C solidity_${VERSION}/build -j `nproc` solc
+
+#
+# Create the .tar.xz file
+#
+
+RUN mv solidity_${VERSION}/build/solc/solc .
+COPY --chmod=755 start.sh .
+RUN tar cfJ /root/solidity-${VERSION}-bounty_riscv64.tar.xz solc start.sh
diff --git a/tests/bounties/solidity-bounty/Makefile b/tests/bounties/solidity-bounty/Makefile
index 59b53d3..7354c0d 100644
--- a/tests/bounties/solidity-bounty/Makefile
+++ b/tests/bounties/solidity-bounty/Makefile
@@ -1,49 +1,12 @@
 ARCH=$(shell uname -m)
-VERSION=0.8.24
-SOURCE_TAR=solidity-$(VERSION).tar.gz
-SOURCE_DIR=solidity_$(VERSION)
-BUILD_DIR=$(SOURCE_DIR)/build
-BOUNTY_TAR=solidity-$(VERSION)-bounty_$(ARCH).tar.xz
+VERSION=0.8.26
 BOUNTY_RISCV64_TAR=solidity-$(VERSION)-bounty_riscv64.tar.xz
 
-CMAKEFLAGS=-DTESTS=OFF -DUSE_Z3=OFF
-
-all: $(BOUNTY_TAR)
-
 riscv64: $(BOUNTY_RISCV64_TAR)
 
-download: | $(SOURCE_DIR)
-
-$(BOUNTY_TAR): solc start.sh
-	tar cfJ $@ $^
-
-$(BUILD_DIR)/solc/solc: | $(SOURCE_DIR) $(BUILD_DIR)
-	$(MAKE) -C $(BUILD_DIR) solc
-
-$(BUILD_DIR):
-	cmake -S $(SOURCE_DIR) -B $(BUILD_DIR) $(CMAKEFLAGS)
-
-solc: $(BUILD_DIR)/solc/solc
-	cp $< $@
-
-$(SOURCE_DIR): $(SOURCE_TAR)
-	tar xzf $<
-
-$(SOURCE_TAR):
-	wget -O $(SOURCE_TAR) https://github.com/ethereum/solidity/releases/download/v$(VERSION)/solidity_$(VERSION).tar.gz
-
-ifneq ($(ARCH), riscv64)
 $(BOUNTY_RISCV64_TAR): Dockerfile start.sh
 	docker build --tag solidity-bounty-cp --file Dockerfile --progress plain --build-arg VERSION=$(VERSION) .
-	docker create --platform=linux/riscv64 --name solidity-bounty-cp solidity-bounty-cp
+	docker create --name solidity-bounty-cp solidity-bounty-cp
 	docker cp solidity-bounty-cp:/root/$@ $@
 	docker rm solidity-bounty-cp
 	touch $@
-endif
-
-clean:
-	rm -f solc $(SOURCE_DIR)-bounty_*.tar.xz
-	if [ -d "$(BUILD_DIR)" ]; then $(MAKE) -C $(BUILD_DIR) clean; fi
-
-distclean: clean
-	rm -rf solidity*
diff --git a/tests/bounties/solidity-bounty/info.json b/tests/bounties/solidity-bounty/info.json
index 2fce593..4f24192 100644
--- a/tests/bounties/solidity-bounty/info.json
+++ b/tests/bounties/solidity-bounty/info.json
@@ -1,5 +1,5 @@
 {
-    "name": "Solidity 0.8.24",
+    "name": "Solidity 0.8.26",
     "description": "Solidity is a programming language for implementing smart contracts on various blockchain platforms, most notably, Ethereum.",
-    "imgLink": "https://upload.wikimedia.org/wikipedia/commons/9/98/Solidity_logo.svg"
+    "imgLink": "https://docs.soliditylang.org/en/v0.8.26/_static/img/logo-dark.svg"
 }
diff --git a/tests/bounties/solidity-bounty/start.sh b/tests/bounties/solidity-bounty/start.sh
index c89858d..e7731c3 100755
--- a/tests/bounties/solidity-bounty/start.sh
+++ b/tests/bounties/solidity-bounty/start.sh
@@ -1,5 +1,5 @@
 #!/bin/sh
-./solc --standard-json $1
+./solc $1
 status=$?
 # Status is always 139 when program crashes with "Segmentation fault" (SIGSEGV)
 if [ $status -eq 139 ]; then