Don’t miss out! Join us at our next event: KubeCon + CloudNativeCon Europe 2022 in Valencia, Spain from May 17-20. Learn more at [ Ссылка ] The conference features presentations from developers and end users of Kubernetes, Prometheus, Envoy, and all of the other CNCF-hosted projects.
Generating seccomp policies with eBPF - Marga Manterola, Microsoft
Seccomp is one of the security mechanisms that can be used in Kubernetes to restrict the system calls that a process running inside a container can execute. In order to use it, the user must define a seccomp profile with the list of allowed system calls. In many cases it’s not very easy to understand what the system calls a process could require are, especially if the user deploying the application is not its developer.
In this lightning talk Marga will present the Seccomp Policy Advisor, an eBPF-based tool that captures all the syscalls that a pod executes to suggest a seccomp profile. Marga will present a demonstration of this tool and will cover its implementation briefly and shows how it integrates with the Kubernetes Security Profiles Operator.
