SeccompDefault is available in public preview as a new parameter through
custom node configuration. Secure
computing mode (seccomp) is used to restrict a container’s syscalls that can be
sent to the kernel. This establishes an extra layer of protection against
common system call vulnerabilities exploited by malicious actors and allows you to specify a
default seccomp profile for all workloads in the node.
There
are two allowed values for SeccompDefault:
- Unconfined is the default parameter
value which does not block any syscalls.
- RuntimeDefault will block restricted
syscalls in the containerd seccomp profile.
The
RuntimeDefault profile allows a common set of syscalls while blocking those
that are less likely to be used or potentially unsafe in a containerized
application. This profile aims to provide a reliable set of security defaults
while maintaining the functionality of the workload.
Learn more.