79319358

Date: 2024-12-31 07:03:40
Score: 1
Natty:
Report link

If you want to use the seccomp profile in your pod without configuring the profile json in /var/lib/kubelet/seccomp/profiles you may use RuntimeDefault seccomp profile.

As per this Official Kubernetes document :

Most container runtimes provide a sane set of default syscalls that are allowed or not. You can adopt these defaults for your workload by setting the seccomp type in the security context of a pod or container to RuntimeDefault.

Note: If you have the seccompDefault configuration enabled, then Pods use the RuntimeDefault seccomp profile whenever no other seccomp profile is specified. Otherwise, the default is Unconfined.

Here's a manifest for a Pod that requests the RuntimeDefault seccomp profile for all its containers:

apiVersion: v1
kind: Pod
metadata:
  name: default-pod
  labels:
    app: default-pod
spec:
  securityContext:
    seccompProfile:
      type: RuntimeDefault
  containers:
  - name: test-container
    image: hashicorp/http-echo:1.0
    args:
    - "-text=just made some more syscalls!"
    securityContext:
      allowPrivilegeEscalation: false

Refer to this document and also check this blog for more information which might be helpful for you.

Reasons:
  • Blacklisted phrase (1): this blog
  • Blacklisted phrase (1): this document
  • Long answer (-1):
  • Has code block (-0.5):
  • Low reputation (0.5):
Posted by: Pranay Kumar Kyasala