#seccomp

RuntimeDefault blocks escape primitives and permits a wide call surface. How to derive a stricter profile from observed workload behaviour without breaking production.

Your container makes about 70 of Linux's 300-odd syscalls. Here's how kguardian works out which 70,...

AppArmor and seccomp Profiles: Restricting Container System Calls A Senior...

Discover four Kubernetes annotations that instantly harden cluster security: seccomp, AppArmor, PSA enforcement, and ingress TLS-only access.

The CNCF's Security Profiles Operator graduated to v1.0.0 on June 26, freezing eight CRD APIs and clearing a third-party audit. The kubelet-side follow-up, KEP 6061 for OCI artifact distribution, is the piece still in flight.

We keep saying it: a container is not a security boundary. A shared kernel means one container...

apply Seccomp to reduce the attack surface of containers

Trying seccomp via mruby with introduction of them