Back to Checks
kubernetes

Pod has the docker/default (RuntimeDefault) seccomp profile at pod level or for all containers

core_seccomp_profile_docker_default
Service: coreSeverity: high
OfficialBuilt-inVerified
Categories:container-security
Resource Type:Pod

Kubernetes Pods and their containers specify the runtime default seccomp profile using seccompProfile.type: RuntimeDefault in the security context.

The evaluation looks for this setting at the Pod level or per container.

Prowler logoProwlerprowler-provider-kubernetes

Risk

Without seccomp RuntimeDefault, containers may run unconfined and invoke risky syscalls, expanding the kernel attack surface.

  • Container escape, privilege escalation (integrity)
  • Data access or exfiltration (confidentiality)
  • Node or workload disruption (availability)

Run this check with Prowler

Run in Prowler Cloud
Run
prowler kubernetes --checks core_seccomp_profile_docker_default

Recommendation

Enforce least privilege for syscalls:

  • Set seccompProfile.type: RuntimeDefault on Pods/containers
  • Use tailored profiles for sensitive workloads
  • Avoid privileged or unconfined containers; drop unused capabilities
  • Combine with AppArmor/SELinux and policy guardrails to enforce and audit

Remediation

CLI

kubectl patch deployment <example_resource_name> --type=merge -p '{"spec":{"template":{"spec":{"securityContext":{"seccompProfile":{"type":"RuntimeDefault"}}}}}}'

Terraform

resource "kubernetes_pod_v1" "example" {
  metadata {
    name = "<example_resource_name>"
  }
  spec {
    security_context {
      seccomp_profile {
        type = "RuntimeDefault" # Critical: enforces the runtime default (docker/default) seccomp profile at pod level
      }
    }
    container {
      name  = "app"
      image = "nginx"
    }
  }
}

Other

1Open the manifest of your workload (Deployment/StatefulSet/Pod)
2Under the Pod spec, add:
3spec:
4securityContext:
5seccompProfile:
6type: RuntimeDefault
7- For controllers (e.g., Deployment), place this under spec.template.spec
8Apply the change: kubectl apply -f <your_manifest.yaml>
9Wait for pods to restart and confirm the setting on new pods

Check Code

from prowler.lib.check.models import Check, Check_Report_Kubernetes
from prowler.providers.kubernetes.services.core.core_client import core_client


class core_seccomp_profile_docker_default(Check):
    def execute(self) -> Check_Report_Kubernetes:
        findings = []
        for pod in core_client.pods.values():
            report = Check_Report_Kubernetes(metadata=self.metadata(), resource=pod)

            pod_seccomp_correct = (
                pod.security_context
                and pod.security_context["seccomp_profile"]
                and pod.security_context["seccomp_profile"]["type"] == "RuntimeDefault"
            )
            containers_seccomp_correct = True

            # Check container-level seccomp profile
            for container in pod.containers.values():
                if not (
                    container.security_context
                    and container.security_context["seccomp_profile"]
                    and container.security_context["seccomp_profile"]["type"]
                    == "RuntimeDefault"
                ):
                    containers_seccomp_correct = False
                    break

            # Determine the report status
            if pod_seccomp_correct or containers_seccomp_correct:
                report.status = "PASS"
                report.status_extended = f"Pod {pod.name} and its containers have docker/default seccomp profile enabled."
            else:
                report.status = "FAIL"
                if not pod_seccomp_correct and not containers_seccomp_correct:
                    report.status_extended = f"Pod {pod.name} does not have docker/default seccomp profile enabled at both pod and container levels."
                elif not pod_seccomp_correct:
                    report.status_extended = f"Pod {pod.name} does not have docker/default seccomp profile enabled at pod level."
                else:
                    report.status_extended = f"Pod {pod.name} does not have docker/default seccomp profile enabled at container level."

            findings.append(report)

        return findings

References