Always use our own seccomp policy as a default. #926
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
almet
force-pushed
the
908-define-seccomp-policy
branch
2 times, most recently
from
2debb87
to
f2b04ba
Compare
apyrgio
force-pushed
the
908-define-seccomp-policy
branch
from
f2b04ba
to
dcc3e88
Compare
apyrgio
approved these changes
Sep 24, 2024
|
I took the liberty to make some rewordings in the PR, in a separate fixup commit. Also, I've commented on the original issue about our change of course on this subject (see #846 (comment)). Other than that, feel free to squash and merge. |
As per Etienne Perot's comment on #908: > Then it seems to me like it would be easy to simply apply this seccomp profile under all container runtimes (since there's no reason why the same image and the same command-line would call different syscalls under different container runtimes).
almet
force-pushed
the
908-define-seccomp-policy
branch
from
7f7fa3c
to
3e434d0
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
As per Etienne Perot's comment on #908:
As mentioned in the comments there, we might want to tighten the default seccomp policy, to have more control on what we accept or not.
Fixes #908