Seccomp, or Secure Computing Mode, is a Linux kernel feature that enhances security by restricting the system calls available to a process. It allows fine-grained control over the system calls a process can make, reducing its attack surface. When enabled in a Kubernetes environment, Seccomp can significantly enhance container security by limiting the system calls that containers are allowed to execute. This prevents applications or processes from making potentially risky or unnecessary system calls, reducing the risk of exploitation by malicious actors.

Remediation

The following example enforces RuntimeDefault seccomp profile on app container.

apiVersion: apps/v1
kind: Deployment
spec:
  template:
    spec:
      securityContext:
        seccompProfile:
          type: RuntimeDefault
      containers:
      - name: app