Seccomp
seccomp is a Linux kernel security facility that restricts the system calls a process and optionally its descendants may invoke.
Podman in Action: Secure, rootless containers for Kubernetes, microservices, and more
A seccomp filter is a policy configuration that determines which system calls a process and its descendants may invoke.
- How it is used
- Limits container system calls to reduce kernel attack paths and support process isolation.
- How deep it goes
- Explains syscall filtering, JSON configuration, capability interaction, and a blocking test, but defers filter-generation details.
- Examples
- Uses Podman’s default JSON filter, a modified mkdir filter, and nested Podman or Docker execution scenarios.
- What you can do after
- Diagnose blocked container operations and apply a custom seccomp JSON filter with Podman.
Kubernetes in Action, Second Edition
seccomp is a Linux kernel security facility that restricts the system calls a process may invoke.
- How it is used
- Applies fine-grained syscall filtering to strengthen isolation between containerized processes.
- How deep it goes
- Defines custom JSON profiles and their Docker handoff, but stops short of showing profile syntax or syscall selection.
- Examples
- Uses a custom JSON allowlist supplied to Docker when creating a container.
- What you can do after
- Operate/configure a container with a custom JSON profile that limits its permitted system calls.
Read how Kubernetes in Action, Second Edition explains seccomp →
Related concepts
- Podmanused by · Podman is a daemonless, open-source container engine for building, running, and managing containers and container images.
- system callconfigures · A system call is an operating-system interface through which a user-space program requests a service or operation from the kernel.
- container escape vulnerabilityaddresses · A security flaw that allows a process confined within a container to access the host or other resources outside the container.
These guides are generated from the text of Manning books by Manning's knowledge graph and link to the sections they draw on. The full books are available on liveBook and at manning.com.