Seccomp Default Deny

A mechanism to strip specific root-level privileges from a container process without granting full superuser access. While seccomp filters system calls, capabilities control what privileged operations those calls can perform.

• CAP_SYS_ADMIN: Often dropped to prevent mount operations and kernel module loading
• CAP_NET_RAW: Removed to block raw socket creation and packet crafting
• CAP_SYS_PTRACE: Disabled to prevent process debugging and memory inspection

Combined with a default-deny seccomp profile, capability dropping ensures that even allowed syscalls cannot execute privileged operations.

A defensive strategy combining multiple kernel isolation primitives to prevent a compromised process from escaping to the host. Seccomp default deny is the foundational layer, blocking the syscalls most commonly used in breakout exploits.

• User namespace remapping: Maps container root to an unprivileged host UID
• Mount namespace isolation: Prevents access to host filesystem paths
• PID namespace restriction: Limits visibility to only the container's process tree
• Cgroup resource limits: Thwarts fork bombs and resource exhaustion attacks

A breakout attempt exploiting a kernel vulnerability typically requires syscalls like unshare, mount, or pivot_root—all blocked by a well-crafted default-deny profile.

The extended Berkeley Packet Filter enables running sandboxed programs directly in the kernel to observe and enforce security policies at runtime. It complements seccomp by providing dynamic, context-aware filtering that static profiles cannot achieve.

• Tracepoint hooks: Monitor syscall invocations in real-time without ptrace overhead
• Network packet filtering: Enforce egress restrictions at the socket level
• File integrity monitoring: Detect unauthorized writes to sensitive paths

Tools like Falco and Tetragon use eBPF to detect anomalous syscall patterns—such as a Python ML container unexpectedly calling ptrace—and trigger alerts or termination before damage occurs.

Minimal container images that contain only the application and its runtime dependencies, excluding package managers, shells, and standard OS utilities. This directly reduces the number of syscalls an attacker can leverage.

• No shell: Eliminates execve calls to /bin/sh or /bin/bash
• No package manager: Prevents apt, yum, or apk from downloading tools
• Smaller attack surface: Fewer binaries mean fewer syscall entry points

When combined with a seccomp default-deny profile, a distroless image creates an environment where even a successful code execution exploit has almost no usable system tools to progress an attack chain.

A Kubernetes-native security gate that intercepts API requests before objects are persisted, enabling enforcement of seccomp profile requirements across the entire cluster.

• Pod Security Admission (PSA): Enforces Restricted profile which mandates seccomp
• OPA/Gatekeeper: Validates that every pod specifies a seccomp profile in its security context
• Kyverno: Mutates pods to inject a default-deny profile if none is specified

Without admission control, developers could accidentally deploy containers with Unconfined seccomp, completely bypassing the default-deny posture. Automated validation ensures consistent enforcement at scale.

The process of tracing a running application to identify the exact set of system calls it requires, enabling the construction of a minimal allowlist for a seccomp-bpf profile.

• Dynamic analysis: Run strace -c during integration tests to capture all syscalls
• Coverage testing: Exercise all code paths, including error handling and edge cases
• Profile generation: Tools like oci-seccomp-bpf-hook can auto-generate profiles from traces

For ML pipelines, profiling must cover training, inference, and data loading phases—each may invoke different syscalls. An incomplete profile causes runtime SIGSYS kills, so thorough tracing is critical before enforcing a default-deny policy in production.