In this lesson, you will learn how to harden your containers by creating custom Seccomp profiles that block unnecessary system calls.
What is Seccomp?
Every time a process inside your container needs to perform an action—like reading a file, opening a network socket, or starting a new process—it makes a system call (syscall) to the host’s Linux kernel. By default, the kernel allows hundreds of these calls. However, most applications only ever use a small fraction of them.
Seccomp (Secure Computing mode) acts as a security gatekeeper. It allows you to create a "whitelist" of syscalls, ensuring the kernel only executes those required for your application to function. If a malicious process attempts to execute an unauthorized syscall, the kernel immediately terminates the process.
Designing a Custom Profile
To create a custom profile, you define a JSON file that specifies the defaultAction as SCMP_ACT_ERRNO (or SCMP_ACT_KILL) and then explicitly whitelist only the necessary syscalls.
For example, if your application is a simple static web server that never needs to reboot the system, you would simply omit the reboot syscall from your list.
Here is a basic structure of a Seccomp profile:
{
"defaultAction": "SCMP_ACT_ERRNO",
"architectures": ["SCMP_ARCH_X86_64"],
"syscalls": [
{
"names": ["read", "write", "exit", "futex"],
"action": "SCMP_ACT_ALLOW"
}
]
}
Why this matters
By applying this profile, you adhere strictly to the Principle of Least Privilege. Even if an attacker gains control of your container process, they will find their tools broken because the kernel refuses to execute high-risk commands like ptrace (often used for debugging or malicious memory inspection) or mount.
In practice, you create this profile as a JSON file on your host and pass it to Docker using the --security-opt flag:
docker run --security-opt seccomp=/path/to/profile.json my-app
This creates a hardened sandbox where your application has exactly enough permissions to do its job, and nothing more.
Key Takeaway: Custom Seccomp profiles reduce your attack surface by explicitly whitelisting only the system calls required for your application and blocking all others by default.