Seccomp Notify on Kubernetes
summary
Seccomp Notify (Linux 5.9) extends kernel seccomp filtering by letting an external Seccomp Agent decide, block, or emulate system calls for a process. The talk explains how runc’s architecture uses Seccomp Notify, shows the current integration status in Kubernetes, demonstrates Kubernetes use cases (e.g., safer privileged workloads and unprivileged container builds), and walks through building a Golang seccomp agent—with mentions of pidfd_getfd and the addfd ioctl.
AI-written summary · about
related talks
34mSeccomp: What Can It Do For You?
44mSeccomp for Developers - Making Applications Simply More Secure
36mSeccomp For Developers - Writing More Secure Applications
01h 29mUsing Seccomp to Limit the Kernel Attack Surface
32mSecuring Kubernetes Applications by Crafting Custom Seccomp Profiles
32mDesigning to the Worst Case Scenario - Practical System Call Filtering with Seccomp
50mImproving Container Security with System Call Interception
43mSandboxes, Seccomp, and Syscalls: Chasing Isolation in Kubernetes (Mark Manning)