Configuring seccomp profiles

An OKD container or a pod runs a single application that performs one or more well-defined tasks. The application usually requires only a small subset of the underlying operating system kernel APIs. Seccomp, secure computing mode, is a Linux kernel feature that can be used to limit the process running in a container to only call a subset of the available system calls. These system calls can be configured by creating a profile that is applied to a container or pod. Seccomp profiles are stored as JSON files on the disk.

Configuring the default seccomp profile

OpenShift ships with a default seccomp profile that is referenced as runtime/default. You can enable the default seccomp profile for a pod or container workload by setting RuntimeDefault as following:

Example

spec:
  securityContext:
    seccompProfile:
      type: RuntimeDefault

Alternatively, you can use the pod annotations seccomp.security.alpha.kubernetes.io/pod: runtime/default and container.seccomp.security.alpha.kubernetes.io/<container_name>: runtime/default. However, this method is deprecated in OKD 4.7.

Configuring a custom seccomp profile

You can configure a custom seccomp profile, which allows you to update the filters based on the application requirements. This allows cluster administrators to have greater control over the security of workloads running in OpenShift Container Platform.

Setting up the custom seccomp profile

Prerequisite

• You have cluster administrator permissions.

• You have created a custom security context constraints (SCC). For more information, see “Additional resources”.

• You have created a custom seccomp profile.

Procedure

1. Upload your custom seccomp profile to /var/lib/kubelet/seccomp/<custom-name>.json by using the Machine Config. See “Additional resources” for detailed steps.

2. Update the custom SCC by providing reference to the created custom seccomp profile:

   seccompProfiles:
   - localhost/<custom-name>.json (1)

   1	Provide the name of your custom seccomp profile.

Applying the custom seccomp profile to the workload

Prerequisite

• The cluster administrator has set up the custom seccomp profile. For more details, see “Setting up the custom seccomp profile”.

Procedure

• Apply the seccomp profile to the workload by setting the securityContext.seccompProfile.type field as following:

  Example

  spec:
    securityContext:
      seccompProfile:
        type: Localhost
        localhostProfile: <custom-name>.json (1)

  1	Provide the name of your custom seccomp profile.

  Alternatively, you can use the pod annotations seccomp.security.alpha.kubernetes.io/pod: localhost/<custom-name>.json. However, this method is deprecated in OKD 4.7.

During deployment, the admission controller validates the following:

• The annotations against the current SCCs allowed by the user role.

• The SCC, which includes the seccomp profile, is allowed for the pod.

If the SCC is allowed for the pod, the kubelet runs the pod with the specified seccomp profile.

Additional resources

• Managing security context constraints

• Post-installation machine configuration tasks