Seccomp — filter system calls for containers.
1apiVersion: v12kind: Pod3metadata:4 name: seccomp-pod5spec:6 securityContext:7 seccompProfile:8 type: RuntimeDefault9 containers:10 - name: app11 image: nginx:latest12 securityContext:13 seccompProfile:14 type: RuntimeDefault
1kubectl exec seccomp-pod -- cat /proc/1/status | grep Seccomp
Profiles: RuntimeDefault, Localhost, Unconfined.