If you want to use the seccomp profile in your pod without configuring the profile json in /var/lib/kubelet/seccomp/profiles you may use RuntimeDefault
seccomp profile.
As per this Official Kubernetes document :
Most container runtimes provide a sane set of default syscalls that are allowed or not. You can adopt these defaults for your workload by setting the seccomp type in the security context of a pod or container to
RuntimeDefault
.Note: If you have the
seccompDefault
configuration enabled, then Pods use theRuntimeDefault
seccomp profile whenever no other seccomp profile is specified. Otherwise, the default isUnconfined
.Here's a manifest for a Pod that requests the
RuntimeDefault
seccomp profile for all its containers:apiVersion: v1 kind: Pod metadata: name: default-pod labels: app: default-pod spec: securityContext: seccompProfile: type: RuntimeDefault containers: - name: test-container image: hashicorp/http-echo:1.0 args: - "-text=just made some more syscalls!" securityContext: allowPrivilegeEscalation: false
Refer to this document and also check this blog for more information which might be helpful for you.