Runtime security provides proactive protection for running containers by detecting and blocking malicious activity and reducing the application's attack surface.
ACK supports Linux kernel mechanisms for runtime security — capabilities, seccomp, and AppArmor — and managed detection tools such as ACK inspection and Alibaba Cloud Security Center. Choose the right mechanism for your workload.
Kubernetes does not provide built-in mechanisms for loading AppArmor profiles onto nodes. Load profiles onto a node before referencing them in a pod spec — the scheduler is unaware of which nodes have which profiles.
Use seccomp to limit syscalls
Secure computing mode (seccomp) is a Linux kernel syscall filter. Unlike SELinux, seccomp does not isolate containers — instead, it protects the host kernel by intercepting syscalls and allowing only those in an allowlist.
Docker and containerd ship with a default seccomp profile suitable for most workloads. See the Docker default seccomp profile.
Decide between Linux capabilities and seccomp
Before writing a seccomp policy, check whether Linux capabilities give you the control you need. Capabilities apply checks to kernel functions reachable through syscalls; seccomp filters the syscalls themselves. Capabilities are simpler and sufficient for most use cases.
If capabilities alone cannot achieve the required restriction, configure seccomp. See Set capabilities for a container.
Generate a seccomp profile
To identify which syscalls your application makes, use strace to generate a stack trace, then use syscall2seccomp to create a seccomp profile from the trace data.
Apply a seccomp profile to a pod
The method for applying a seccomp profile depends on your Kubernetes version.
Kubernetes 1.19 and later (recommended)
Add a seccompProfile field to the pod's security context:
securityContext:
seccompProfile:
type: RuntimeDefaultKubernetes versions earlier than 1.19
Use an annotation on the pod spec:
annotations:
seccomp.security.alpha.kubernetes.io/pod: "runtime/default"Enable RuntimeDefault cluster-wide
From Kubernetes 1.27 (GA), a single kubelet flag applies the RuntimeDefault profile to all pods on a node without per-pod securityContext changes. For Kubernetes 1.22–1.24 (Alpha), SeccompDefault is disabled by default and requires enabling the feature gate.
-
For Kubernetes 1.22–1.24: add
--feature-gates=SeccompDefault=trueto the kubelet configuration file on each node. -
Add
--seccomp-defaultto the kubelet configuration file on each node. -
Restart the kubelet.
After the kubelet restarts, pods on that node use the runtime's default seccomp profile. Syscalls outside the allowlist are blocked.
Test this configuration in a non-production environment before rolling it out to production nodes. Enabling --seccomp-default affects all pods on the node.
Use a third-party solution to manage profiles
If the default runtime profile does not meet your requirements, use a custom seccomp profile. Custom seccomp and AppArmor profiles require in-depth Linux security knowledge. Third-party solutions use machine learning to detect and block abnormal activity, providing stronger protection than static profiles.
Use the ACK inspection feature
ACK clusters include an inspection feature that detects workload security risks in real time. Review the failed items and suggested remediation steps after each inspection to improve workload security.
Review all inspection checks and suggestions in Inspection suggestions.
Use Alibaba Cloud Security Center
Security Center detects and blocks threats in cloud-native application runtimes. It collects threat intelligence, analyzes threats, identifies sources, and responds to incidents.
Security Center capabilities:
-
Correlates logs from multiple sources to detect risks in real time, including malicious code or command execution, SQL injections, and data breaches
-
Audits actions from Kubernetes and operations logs to identify risks such as container escapes, AccessKey breaches, and unauthorized access across ACK and other orchestration platforms