Default seccomp profiles turn container breakout risk into a narrower syscall surface

Containers share a Linux kernel with the host and with other containers. Namespaces limit what a process can see, and cgroups limit resources, but the process still makes system calls into the kernel. Seccomp reduces that interface by restricting which system calls a process may make. It does not replace user namespaces, capabilities, network policy, or filesystem isolation, but it removes opportunities from code that should never need certain kernel operations.

Kubernetes exposes seccomp through a container security context. RuntimeDefault applies the container runtime's default profile, while Localhost selects a profile installed on the node. An unset or Unconfined value leaves the process with a broader syscall surface.…