Set seccomp through securityContext.seccompProfile. For most Pods, RuntimeDefault is the practical starting point: the container runtime supplies its default syscall filter, avoiding a hand-maintained allowlist. Use Localhost when you need an operator-managed, workload-specific JSON profile installed on every eligible node. These choices are not interchangeable across runtimes, and a restrictive or missing profile can stop a workload from starting or functioning.
What Kubernetes seccomp does
Seccomp filters the Linux system calls a process may make. Kubernetes lets you select the profile through a Pod or container security context, while the container runtime provides or loads the actual filter. That distinction matters: Kubernetes exposes the choice, but does not make every runtime’s default profile identical.
As an Amazon Associate I earn from qualifying purchases.
The API supports three profile types:
| Type | Who supplies it and where it comes from | Portability and operational effect |
|---|---|---|
RuntimeDefault |
The container runtime supplies its default profile. | Behavior can vary by runtime and release; verify it on the nodes that will run the workload. |
Localhost |
The operator supplies a JSON profile file on each relevant node. | Requires consistent profile distribution and scheduling; a missing file causes container creation to fail. |
Unconfined |
No seccomp restrictions are applied. | Not an allowed seccomp value under the Restricted Pod Security Standard. |
Kubernetes seccomp support has been Stable since v1.19. This feature milestone does not mean a cluster has enabled a particular default. See the Kubernetes seccomp reference and seccomp tutorial.
Recommended Free Tools
How do I set a seccomp profile for a Kubernetes Pod?
Put the profile at Pod level when its containers should share a setting. A container-specific value takes precedence; containers without one inherit the Pod value. Kubernetes also permits settings on init and ephemeral containers, so inspect those scopes as well as regular containers and injected sidecars.
#1 Best Overall
apiVersion: v1
kind: Pod
metadata:
name: app
spec:
securityContext:
seccompProfile:
type: RuntimeDefault
containers:
- name: app
image: example/image:tagTo override the Pod setting for one container, add its own securityContext:
- name: special
image: example/special:tag
securityContext:
seccompProfile:
type: Localhost
localhostProfile: profiles/special.jsonUse the API field names and nesting as shown; the Localhost example assumes that profiles/special.json exists under the kubelet’s configured seccomp profile directory on every node that may run that container. The security context configuration guide documents Pod and container settings.
Does RuntimeDefault mean the same thing on containerd and CRI-O?
No. RuntimeDefault asks the runtime to apply its default profile; the profile’s exact behavior may differ between containerd and CRI-O, and between releases of either runtime. Do not assume that a workload tested on one node has identical syscall restrictions everywhere in a mixed or changing fleet.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesInspect the effective runtime configuration on the actual nodes. Kubernetes documentation identifies crictl inspect as one way to inspect runtime configuration. Then exercise the workload under the profile: a successful Pod start alone does not establish that all application paths work.
Rank #3
Where does Kubernetes look for a Localhost seccomp profile?
A Localhost profile name is relative to the kubelet’s configured seccomp profile directory. On Linux, Kubernetes documents /var/lib/kubelet/seccomp as the default directory. The kubelet configuration may use another location, so check the node’s configuration rather than treating that path as universal.
For example, with localhostProfile: profiles/special.json and the documented default directory, the profile file is expected at /var/lib/kubelet/seccomp/profiles/special.json on each relevant node. The file must be present before the container is created; if it is unavailable, container creation fails. Distribute profiles consistently and constrain scheduling as needed so a Pod does not succeed only on nodes that happen to have the file.
Why RuntimeDefault is usually the better starting point
A custom profile means owning its contents, compatibility, distribution, and updates. RuntimeDefault delegates the baseline to the runtime and is often preferable when it already allows the workload’s required system calls. Kubernetes describes default profiles as aiming to provide strong security defaults while preserving workload functionality. That is an aim, not a guarantee for every application.
The trade-off is control versus maintenance: RuntimeDefault is simpler but runtime-dependent; Localhost gives you an explicit operator-managed profile but adds node-level deployment and compatibility work. A hand-written profile is appropriate when a concrete workload need justifies that ownership—not merely because a custom allowlist appears more precise.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How to develop and roll out a profile safely
Kubernetes’ seccomp tutorial demonstrates using an audit profile and then refining to a more restrictive profile. Treat that as a way to observe and test workload needs, not as a universal syscall list.
- Choose a representative workload and environment. Include the application paths, startup behavior, and helper containers that matter in production.
- Start with RuntimeDefault or an observed, workload-specific need. Avoid copying an assumed universal custom profile; requirements depend on the workload and runtime.
- Test the profile and application behavior. Check container creation and meaningful workload operations, not just whether the manifest is accepted.
- Verify the actual nodes and scopes. Confirm runtime behavior and inspect regular, init, ephemeral, and injected containers for overrides or inherited settings.
- Roll out to a tested subset first. Expand only after the subset behaves correctly. If a workload fails, identify the syscall requirement and whether the cause is the profile or runtime before broadening access or disabling seccomp.
The tutorial’s audit and refinement approach is described in the official Kubernetes seccomp tutorial.
How seccomp interacts with privileged containers and Pod Security
Privileged containers
A container with privileged: true always runs Unconfined. A Pod- or container-level RuntimeDefault or Localhost setting does not constrain it. Kubernetes states: “Privileged containers always run as Unconfined.”
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Restricted Pod Security Standard
The Restricted standard permits RuntimeDefault and Localhost and requires an allowed seccomp setting at the relevant Pod or container scope. Although Unconfined is a valid API option generally, it is not an allowed value under Restricted. Admission policy and node capability are separate checks: a manifest passing admission does not prove a node has the Localhost file. See the Pod Security Standards.
Defaulting with the kubelet option
The kubelet’s seccompDefault option applies RuntimeDefault to workloads that do not specify a profile. It must be enabled on each node where this behavior is intended; do not infer that it is enabled because seccomp support is Stable. The option has been documented Stable since Kubernetes v1.27, but that milestone is not a guarantee that every distribution enables it. Test on a subset of nodes before expanding. The Seccomp by default KEP describes the option; managed Kubernetes behavior is provider- and configuration-specific. For GKE, consult Google Cloud’s GKE seccomp documentation.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
