Define custom seccomp filters for container services #191

New issue

Open

opened 2025-05-01 20:26:02 +02:00 by histalek · 0 comments

histalek commented

2025-05-01 20:26:02 +02:00

Owner

(Semi copy&paste from my old repo)

This would decrease the attack surface for rogue container processes.
Instead of manually checking for needed syscalls, the OCI seccomp runtime hook could be used to create a list of these syscalls.
The hook uses eBPF which needs root privileges. So for rootless containers these would need to be created beforehand in a rootfull way.
Ref.: RH-Article "Improving Linux container security with seccomp

(Semi copy&paste from my old repo) This would decrease the attack surface for rogue container processes. Instead of manually checking for needed syscalls, the [OCI seccomp runtime hook](https://github.com/containers/oci-seccomp-bpf-hook) could be used to create a list of these syscalls. The hook uses [eBPF](https://ebpf.io/what-is-ebpf/) which needs root privileges. So for rootless containers these would need to be created beforehand in a rootfull way. Ref.: [RH-Article "Improving Linux container security with seccomp](https://www.redhat.com/en/blog/container-security-seccomp)

👍 1

No labels

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: SipsOfCode/infrastructure#191

No description provided.

Rows
Columns