Review container seccomp profiles

Description

Seccomp reduces the kernel attack surface by restricting system calls available to container processes. Unconfined execution does not use these restrictions. A profile may still be applied through kubelet or runtime defaults when no explicit setting is present, so verify the effective configuration.

Potential impact

Unnecessary system calls can increase the functions a compromised process can misuse.
A profile incompatible with the application can block legitimate operations.

Remediation

For supported Linux workloads, set type = "RuntimeDefault" in security_context.seccomp_profile or use a reviewed Localhost profile. Check container-level overrides and privileged execution as well.
Test required functions and inspect denial logs after applying the profile. Retain non-root execution, minimum capabilities and security updates alongside seccomp.

Examples

These examples replace an incorrect legacy annotation with the supported seccomp_profile block. Linux nodes and a compatible provider are required. Use a maintained image for deployment.

Before

hcl

resource "kubernetes_pod" "pod" {
  metadata {
    name = "terraform-example"
  }

  spec {
    security_context {
      seccomp_profile {
        type = "Unconfined"
      }
    }

    container {
      image = "nginx:1.7.9"
      name  = "example"
    }
  }
}

After

hcl

resource "kubernetes_pod" "pod" {
  metadata {
    name = "terraform-example"
  }

  spec {
    security_context {
      seccomp_profile {
        type = "RuntimeDefault"
      }
    }

    container {
      image = "nginx:1.7.9"
      name  = "example"
    }
  }
}

Explanation:

Before: Unconfined execution does not use seccomp restrictions.
After: The runtime’s default seccomp profile is explicitly requested.