Your containers can make 300+ syscalls. Most need under 20. Lock that down with AppArmor and seccomp profiles before an escape happens. Guide:
#AppArmor #seccomp #Kubernetes
@hugovalters.bsky.social
@hugovalters.bsky.socialYour containers can make 300+ syscalls. Most need under 20. Lock that down with AppArmor and seccomp profiles before an escape happens. Guide:
#AppArmor #seccomp #Kubernetes
@hugovalters.bsky.socialDocker writes your profile into the OCI spec at create time, and the kernel transitions init via change_profile. Pin one with --security-opt apparmor=name.
https://www.valtersit.com/vault/pin-a-percontainer-apparmor-profile-via-docker-runtime-flag-a29ffa/
#apparmor #docker #container-security
@flozz.fr🟠 Nouvel article sur le blog !
Aujourd'hui petit article rapide AppArmor qui cause quelques petits soucis à wg-quick sous Ubuntu 26.04.
➡️ blog.flozz.fr/2026/10/12/w...
Bonne lecture ! 😃
@hugovalters.bsky.socialAppArmor and seccomp Profiles: Restricting Container System Calls — hands-on guide for sysadmins. #AppArmor #seccomp #containersecurity
@hugovalters.bsky.socialYour containers can make hundreds of syscalls they never need. That's how escapes start. This guide shows AppArmor and seccomp profiles https://www.valtersit.com/guides/security/apparmor-and-seccomp-profiles-restricting-container-system-calls/ #AppArmor #seccomp #Kubernetes