Seccomp Profiles

Securing container runtimes with seccomp profiles is a critical step in hardening containerized applications. Seccomp (Short for Secure Computing Mode) is a Linux kernel feature that restricts the system calls a process can make, thereby limiting potential attack surfaces. By applying seccomp profiles to containers, you can enforce strict policies that prevent malicious or unintended behavior, such as unauthorized access to hardware, filesystem operations, or network resources.

Understanding Seccomp in Container Runtimes¶

Seccomp operates by filtering system calls at the kernel level. When enabled, a process can only invoke system calls explicitly allowed by its seccomp profile. This is particularly valuable in containers, where untrusted code might otherwise exploit kernel-level privileges.

By default, Docker and other container runtimes use default seccomp profiles that block most high-risk system calls (e.g., execve, ptrace, setuid). However, these profiles may not be sufficient for all use cases, requiring customization for stricter security or compatibility with specific applications.

Creating Seccomp Profiles¶

Seccomp profiles are defined as JSON files that specify allowed system calls and their arguments. You can create custom profiles using tools like audit2allow (from AppArmor/SELinux) or manually edit JSON templates.

Example: Minimal Seccomp Profile¶

{
  "version": 2,
  "defaultAction": "SCMP_ACT_ERRNO",
  "syscalls": [
    {
      "name": "read",
      "action": "SCMP_ACT_ALLOW"
    },
    {
      "name": "write",
      "action": "SCMP_ACT_ALLOW"
    },
    {
      "name": "exit",
      "action": "SCMP_ACT_ALLOW"
    }
  ]
}

This profile allows only read, write, and exit system calls, blocking all others. Save this as minimal.json.

Applying Profiles to Containers¶

To apply a seccomp profile to a container, use the --security-opt flag with docker run. For example:

docker run --security-opt seccomp=/path/to/minimal.json nginx

This instructs Docker to use the minimal.json profile for the container. If the profile is invalid or missing, Docker will fail to start the container.

Using Default Profiles¶

Docker provides default seccomp profiles for most Linux distributions. To check the active profile:

docker inspect --format='{{.HostConfig.SecurityOpt}}' <container_id>

Validating and Testing Profiles¶

After applying a profile, validate its effectiveness using tools like checksec or by monitoring container behavior. For example:

docker run --rm -it --security-opt seccomp=/path/to/profile alpine sh

Inside the container, attempt to invoke restricted system calls (e.g., execve or ptrace). If the profile is correctly applied, the container will fail with an error.

Best Practices¶

Start with defaults: Use Docker’s default seccomp profiles as a baseline for most workloads.
Customize selectively: Only restrict system calls that are unnecessary for your application’s functionality.
Test thoroughly: Validate profiles in staging environments before deploying to production.
Audit regularly: Periodically review and update profiles to address new vulnerabilities or requirements.
Combine with other tools: Use seccomp alongside AppArmor, SELinux, or Kata Containers for layered security.

Key takeaways¶

Seccomp profiles restrict system calls to limit container privileges and mitigate risks.
Docker’s default profiles block high-risk operations, but custom profiles may be needed for stricter policies.
Apply profiles using --security-opt and validate them through testing and monitoring.
Always balance security with application requirements to avoid unintended disruptions.
Combine seccomp with other security mechanisms for comprehensive container runtime protection.