Pod uses the RuntimeDefault seccomp profile

Check ID: core_seccomp_profile_docker_default
Provider: Kubernetes
Service: core
Severity: HIGH
Categories: container-security
Resource type: Pod

What this check verifies

Kubernetes Pods and their containers specify the runtime default seccomp profile using seccompProfile.type: RuntimeDefault in the security context. The evaluation looks for this setting at the Pod level or per container.

Risk

Without seccomp RuntimeDefault, containers may run unconfined and invoke risky syscalls, expanding the kernel attack surface.

Container escape, privilege escalation (integrity)
Data access or exfiltration (confidentiality)
Node or workload disruption (availability)

Recommendation

Enforce least privilege for syscalls:

Set seccompProfile.type: RuntimeDefault on Pods/containers
Use tailored profiles for sensitive workloads
Avoid privileged or unconfined containers; drop unused capabilities
Combine with AppArmor/SELinux and policy guardrails to enforce and audit

Remediation

CLI
Terraform
Dashboard steps

kubectl patch deployment <example_resource_name> --type=merge -p '{"spec":{"template":{"spec":{"securityContext":{"seccompProfile":{"type":"RuntimeDefault"}}}}}}'

resource "kubernetes_pod_v1" "example" {
  metadata {
    name = "<example_resource_name>"
  }
  spec {
    security_context {
      seccomp_profile {
        type = "RuntimeDefault" # Critical: enforces the runtime default (docker/default) seccomp profile at pod level
      }
    }
    container {
      name  = "app"
      image = "nginx"
    }
  }
}

References

Where this check fires

This check runs on every scheduled scan against your Kubernetes account. Findings appear at Cloud Security → Findings filterable by Check ID = core_seccomp_profile_docker_default. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to Kubernetes checks

Pod does not contain secret environment variables Etcd requires client certificate authentication

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires