A developer wants a basic syscall filter on app Pods without custom…

Question

A developer wants a basic syscall filter on app Pods without custom profiles. Which seccompProfile setting is appropriate awareness-level hardening?

Accepted Answer

Set seccompProfile.type to RuntimeDefault on the Pod or container securityContext. — RuntimeDefault is the stock "safe syscall playlist" the container runtime already ships. Point seccompProfile at it for baseline filtering without hand-writing profiles. Privileged mode and hostNetwork don't give you that filter for free.

Answer

Set privileged: true, which automatically enables the strictest seccomp profile.

Answer

Add hostNetwork: true so the node’s seccomp profile is inherited by the Pod.

Answer

Configure seccomp only on the Service selector labels; Pods ignore securityContext seccomp.

A developer wants a basic syscall filter on app Pods without custom profiles. Which seccompProfile setting is appropriate awareness-level hardening?

Short Explanation

Full Explanation