Red Hat Summit Red Hat SummitSupportoConsoleSviluppatoriInizia una provaContatti

Questo contenuto non è disponibile nella lingua selezionata.

Chapter 26. Restricting Application Capabilities Using Seccomp

26.1. Overview
Copia collegamento

Seccomp (secure computing mode) is used to restrict the set of system calls applications can make, allowing cluster administrators greater control over the security of workloads running in OpenShift Container Platform.

Seccomp support is achieved via two annotations in the pod configuration:

  • seccomp.security.alpha.kubernetes.io/pod: profile applies to all containers in the pod that do not override
  • container.seccomp.security.alpha.kubernetes.io/<container_name>: container-specific profile override
Important

Containers are run with unconfined seccomp settings by default.

For detailed design information, refer to the seccomp design document.

26.2. Enabling Seccomp
Copia collegamento

Seccomp is a feature of the Linux kernel. To ensure seccomp is enabled on your system, run: 

$ cat /boot/config-`uname -r` | grep CONFIG_SECCOMP=
CONFIG_SECCOMP=y
Copy to Clipboard Toggle word wrap

26.3. Configuring OpenShift Container Platform for Seccomp
Copia collegamento

A seccomp profile is a json file providing syscalls and the appropriate action to take when a syscall is invoked.

  1. Create the seccomp profile.

    The default profile is sufficient in many cases, but the cluster administrator must define the security constraints of an individual system.

    To create your own custom profile, create a file on every node in the seccomp-profile-root directory.

    If you are using the default docker/default profile, you do not need to create one.

  2. Configure your nodes to use the seccomp-profile-root where your profiles will be stored. In the node-config.yaml via the kubeletArguments: 

    kubeletArguments:
  seccomp-profile-root:
    - "/your/path"
    Copy to Clipboard Toggle word wrap

  3. Restart the node service to apply the changes: 

    # systemctl restart atomic-openshift-node
    Copy to Clipboard Toggle word wrap

  4. In order to control which profiles may be used, and to set the default profile, configure your SCC via the seccompProfiles field. The first profile will be used as a default.

    The allowable formats of the seccompProfiles field include:

    • docker/default: the default profile for the container runtime (no profile required)
    • unconfined: unconfined profile, and disables seccomp

    • localhost/<profile-name>: the profile installed to the node’s local seccomp profile root

      For example, if you are using the default docker/default profile, configure your SCC with: 

      seccompProfiles:
- docker/default
      Copy to Clipboard Toggle word wrap

26.4. Configuring OpenShift Container Platform for a Custom Seccomp Profile
Copia collegamento

To ensure pods in your cluster run with a custom profile:

  1. Create the seccomp profile in seccomp-profile-root.

  2. Configure seccomp-profile-root: 

    kubeletArguments:
  seccomp-profile-root:
    - "/your/path"
    Copy to Clipboard Toggle word wrap

  3. Restart the node service to apply the changes: 

    # systemctl restart atomic-openshift-node
    Copy to Clipboard Toggle word wrap

  4. Configure your SCC: 

    seccompProfiles:
- localhost/<profile-name>
    Copy to Clipboard Toggle word wrap
Torna in cima
Red Hat logoGithubredditYoutubeTwitter

Formazione

Prova, acquista e vendi

Community

Informazioni sulla documentazione di Red Hat

Aiutiamo gli utenti Red Hat a innovarsi e raggiungere i propri obiettivi con i nostri prodotti e servizi grazie a contenuti di cui possono fidarsi. Esplora i nostri ultimi aggiornamenti.

Rendiamo l’open source più inclusivo

Red Hat si impegna a sostituire il linguaggio problematico nel codice, nella documentazione e nelle proprietà web. Per maggiori dettagli, visita il Blog di Red Hat.

Informazioni su Red Hat

Forniamo soluzioni consolidate che rendono più semplice per le aziende lavorare su piattaforme e ambienti diversi, dal datacenter centrale all'edge della rete.

Theme

© 2025 Red Hat