Kubernetes Security: Unconfined seccomp profile

seccompProfile.type: Unconfined removes syscall filtering and raises kernel attack risk. Use RuntimeDefault or approved Localhost profiles.

Problem

Using seccompProfile.type: Unconfined disables syscall filtering and expands kernel attack surface. This removes one of the most effective container hardening controls. Action: default to RuntimeDefault and allow Localhost profiles only for approved exceptions.

Description

Seccomp limits the syscalls a process can execute. Most workloads need only a subset, so filtering unused syscalls reduces exploit paths and post-exploit options. Action: set RuntimeDefault at pod level in all baseline workloads.

Unconfined often starts as a quick compatibility workaround, then remains in place for months. That drift becomes a blocker in hardened clusters where admission policy rejects weak profiles. Action: track every seccomp exception with owner and deadline, then remove it on schedule.

Risk grows sharply when unconfined seccomp is combined with privileged containers, host namespaces, or broad capabilities. Multiple protection layers fail at once. Action: ban these combinations in production namespaces and enforce policy with admission controls.

Use this rollout checklist to make migration predictable:

  • Enforce RuntimeDefault by default in manifests and policy.
  • Collect denied syscall logs when compatibility issues appear.
  • Build minimal Localhost profiles only for proven runtime needs.
  • Re-test custom profiles after kernel or container-runtime upgrades.

Treat verification as part of the rule, not optional cleanup. Action: automate a static check, a build check, and a runtime smoke check in the default CI pipeline so regressions are caught before review.

  • Static check: fail when the disallowed pattern appears in Dockerfile or manifest.
  • Build check: run a minimal image build to confirm the secure pattern is valid.
  • Runtime check: start the workload and assert expected behavior with one deterministic probe.

Examples of code

Problematic code

apiVersion: v1
kind: Pod
metadata:
  name: api-unconfined
spec:
  securityContext:
    seccompProfile:
      type: Unconfined
  containers:
    - name: api
      image: nginx:1.29-alpine

Verified code

apiVersion: v1
kind: Pod
metadata:
  name: api-secure
spec:
  securityContext:
    seccompProfile:
      type: RuntimeDefault
  containers:
    - name: api
      image: nginx:1.29-alpine

Related rules