seccomp profile is not set to Docker/Default or Runtime/Default
Description
Secure computing mode (seccomp) is a Linux kernel feature used to restrict actions available within the container. The seccomp() system call operates on the seccomp state of the calling process. The default seccomp profile provides a reliable setting for running containers with seccomp and disables non-essential system calls.
Fix - Buildtime
Kubernetes
- Resource: Pod / Deployment / DaemonSet / StatefulSet / ReplicaSet / ReplicationController / Job / CronJob
- Argument: metadata:annotations (Optional)
Annotations attach arbitrary non-identifying metadata to objects.
```yaml Pod
apiVersion: v1
kind: Pod
metadata:
name:
```yaml CronJob
apiVersion: batch/v1beta1
kind: CronJob
metadata:
name: <name>
spec:
schedule: <>
jobTemplate:
spec:
template:
metadata:
annotations:
+ seccomp.security.alpha.kubernetes.io/pod: "docker/default"
or
+ seccomp.security.alpha.kubernetes.io/pod: "runtime/default"
yaml Other
apiVersion: <>
kind: <kind>
metadata:
name: <name>
spec:
template:
metadata:
annotations:
+ seccomp.security.alpha.kubernetes.io/pod: "docker/default"
or
+ seccomp.security.alpha.kubernetes.io/pod: "runtime/default"