Skip to main content

Seccomp Profile Is Set Docker/Default In Your Pod

More Info:​

Enable docker/default seccomp profile in your pod definitions

Risk Level​

High

Address​

Security

Compliance Standards​

  • CIS GKE

Triage and Remediation​

Remediation​

Manual Steps

  1. Identify pods to review (any machine with kubectl access)
    Use label/namespace filters as appropriate; to start with everything:

    kubectl get pods --all-namespaces -o jsonpath='{range .items[*]}{.metadata.namespace}{" "}{.metadata.name}{" "}{.metadata.annotations.seccomp\.security\.alpha\.kubernetes\.io/pod}{"\n"}{end}' | sort

    This lists each pod and its pod-level seccomp annotation (if any). Note pods missing docker/default.

  2. Check container-level seccomp annotations (any machine with kubectl access)
    For pods you are reviewing, inspect full annotations to see container-specific overrides:

    kubectl get pod <pod-name> -n <namespace> -o yaml | grep -A3 'seccomp.security.alpha.kubernetes.io'

    Determine whether each container is using docker/default, another profile (e.g. unconfined), or none.

  3. Decide policy exceptions (any machine with kubectl access)
    With security and application owners, decide:

    • Which namespaces/workloads must use docker/default
    • Which, if any, need a different profile or unconfined for functional reasons
      Document approved exceptions before changing manifests.

  4. Update workload manifests to set docker/default (any machine with kubectl access)
    For non-exempt workloads managed via manifests/Helm/Kustomize, edit the source manifests, not live objects. Add either pod-level or container-level annotations, for example:

    • Pod-level: 
      metadata:
        annotations:
          seccomp.security.alpha.kubernetes.io/pod: docker/default
    • Container-level (per-container override): 
      metadata:
        annotations:
          seccomp.security.alpha.kubernetes.io/<container-name>: docker/default

    Apply via your normal deployment pipeline (e.g., kubectl apply -f <file>, helm upgrade, or GitOps).

  5. Re‑deploy or roll pods so new annotations take effect (any machine with kubectl access)
    After manifest changes, ensure pods are recreated:

    • For Deployments/DaemonSets/StatefulSets: rely on rolling updates from the apply/upgrade, or trigger: 
      kubectl rollout restart deployment/<deployment-name> -n <namespace>
    • For static or singleton pods created manually, delete and recreate from the updated manifest: 
      kubectl delete -f <updated-manifest>.yaml
      kubectl apply -f <updated-manifest>.yaml

  6. Verify effective configuration (any machine with kubectl access)
    Re-run a cluster-wide check to confirm pods now have docker/default configured where required:

    kubectl get pods --all-namespaces -o jsonpath='{range .items[*]}{.metadata.namespace}{" "}{.metadata.name}{" "}{.metadata.annotations.seccomp\.security\.alpha\.kubernetes\.io/pod}{"\n"}{end}' | sort

    For spot checks, validate specific pods:

    kubectl get pod <pod-name> -n <namespace> -o yaml | grep -A3 'seccomp.security.alpha.kubernetes.io'

    Confirm that annotations match your policy decisions (docker/default or documented exceptions).

Using kubectl

On any machine with kubectl access:

  1. List all pods and their seccomp-related annotations
kubectl get pods -A \
  -o custom-columns='NAMESPACE:.metadata.namespace,NAME:.metadata.name,SECCOMP_POD:.metadata.annotations.seccomp\.security\.alpha\.kubernetes\.io/pod,SECCOMP_CONTAINER:.metadata.annotations.seccomp\.security\.alpha\.kubernetes\.io/container\.default'

Problem indication:

  • SECCOMP_POD is empty/<none> and
  • SECCOMP_CONTAINER is empty/<none> for pods that you expect to be constrained.
  1. Inspect annotations on a specific pod
kubectl get pod <pod-name> -n <namespace> -o yaml | grep -A5 "annotations:"

Problem indication:

  • Missing seccomp.security.alpha.kubernetes.io/pod: docker/default
  • Or present but set to anything other than docker/default.
  1. See pods that have any seccomp alpha annotation (to focus review)
kubectl get pods -A -o json | jq -r '
  .items[] |
  select(.metadata.annotations |
    has("seccomp.security.alpha.kubernetes.io/pod") or
    has("seccomp.security.alpha.kubernetes.io/container.default")) |
  [.metadata.namespace, .metadata.name,
   .metadata.annotations["seccomp.security.alpha.kubernetes.io/pod"],
   .metadata.annotations["seccomp.security.alpha.kubernetes.io/container.default"]] |
  @tsv'

Problem indication:

  • Annotations present but value not docker/default, if your policy is to use docker/default.
  1. Confirm api-server alpha feature gate status (to see if the annotation can even work)

If the control plane is exposed as a pod (typical managed GKE):

kubectl -n kube-system get pods -l component=kube-apiserver -o yaml | grep -A2 "\-\-feature-gates"

Problem indication:

  • --feature-gates does not include AllAlpha=true (per the benchmark’s remediation requirement for this check).
Automation
#!/usr/bin/env bash
# Report pods that are NOT using the docker/default seccomp profile at pod scope
# Run on: any machine with kubectl access and current context set

set -euo pipefail

echo "Cluster-wide seccomp (pod-level) report - pods missing 'docker/default'"
echo "Context: $(kubectl config current-context)"
echo

# 1) List all pods with their pod-level seccomp annotation
echo "== Raw pod-level seccomp annotations =="
kubectl get pods -A -o=jsonpath='{range .items[*]}{.metadata.namespace}{"\t"}{.metadata.name}{"\t"}{.metadata.annotations.seccomp\.security\.alpha\.kubernetes\.io/pod}{"\n"}{end}' \
  | sort
echo

# 2) Show only pods that are missing or not set to docker/default
echo "== Pods MISSING pod-level 'docker/default' seccomp profile =="
echo "# Columns: NAMESPACE  POD  POD_SECCOMP_ANNOTATION"
kubectl get pods -A -o=jsonpath='{range .items[*]}{.metadata.namespace}{"\t"}{.metadata.name}{"\t"}{.metadata.annotations.seccomp\.security\.alpha\.kubernetes\.io/pod}{"\n"}{end}' \
  | awk -F'\t' '
    {
      ns=$1; pod=$2; ann=$3;
      # Treat literal "null" or empty as unset
      if (ann == "" || ann == "null" || ann != "docker/default") {
        print ns "\t" pod "\t" (ann == "" || ann == "null" ? "<unset>" : ann);
      }
    }
  ' \
  | sort
echo

cat <<'EOF'
INTERPRETING THE OUTPUT
-----------------------
- The "Raw pod-level seccomp annotations" section shows the exact current value of
  metadata.annotations["seccomp.security.alpha.kubernetes.io/pod"] for every pod.

- In "Pods MISSING pod-level 'docker/default' seccomp profile":
  * Any line with third column "<unset>" means the pod has NO pod-level seccomp
    annotation configured.
  * Any line where the third column is NOT "docker/default" (e.g. "unconfined"
    or some other value) means the pod does not meet the benchmark expectation.

These pods should be reviewed manually. For pods that should comply with CISGKE 4.6.2,
update their manifests (Deployments, DaemonSets, etc.) to include:
  metadata:
    annotations:
      seccomp.security.alpha.kubernetes.io/pod: docker/default
EOF

Additional Reading:​