liveBook · Manning

Seccomp

As explained in Kubernetes in Action, Second Edition

seccomp is a Linux kernel security facility that restricts the system calls a process may invoke.

seccomp, or Secure Computing Mode, is a Linux kernel security facility that provides fine-grained control over the system calls a containerized process may make. section 2.3.4

A custom seccomp profile is a JSON file listing the system calls a container is allowed to invoke; Docker receives the profile when creating the container. section 2.3.4

Filtering container system calls

A container that needs fine-grained isolation can be created with a JSON seccomp profile containing only its permitted system calls. Seccomp complements namespaces, control groups, capabilities, AppArmor, and SELinux rather than replacing them. section 2.3.4 section 2.4

How Kubernetes in Action, Second Edition covers it

How deep it goes
Defines custom JSON profiles and their Docker handoff, but stops short of showing profile syntax or syscall selection.
Examples
Uses a custom JSON allowlist supplied to Docker when creating a container.
What it assumes
Assumes basic understanding of namespaces while presenting seccomp as one part of layered container isolation.
What you can do after
Operate/configure a container with a custom JSON profile that limits its permitted system calls.
How it connects
Connects seccomp with namespaces, control groups, capabilities, AppArmor, and SELinux as complementary isolation mechanisms.
Cover of Kubernetes in Action, Second Edition
liveBookmanning.com
Read Kubernetes in Action, Second Edition on liveBook Get the book at manning.com

Also explained in

Compare how 2 books explain seccomp →

Related concepts

This explainer was generated by Manning's knowledge graph from the text of Kubernetes in Action, Second Edition. The section links point to the parts of the book it draws on.