docs: update seccomp documentation #4902

osamakader · 2025-09-26T20:11:54Z

Update seccomp documentation.

rata · 2025-09-29T10:12:49Z

libcontainer/SPEC.md

 ```

-*TODO: seccomp work is being done to find a good default config*
+*Seccomp filtering is supported with configurable default profiles*


Not sure what you mean with a configurable default profile. There is no default profile AFAIK.

Also, considering how extensive this doc tends to be, maybe we can add some example seccomp profile here?

I was about to comment the same thing -- this is talking about the default configuration for runc, and we don't have a default seccomp profile. Upstream runtimes have their own profiles but we do not yet have a default one.

But yes, a better PR would be to provide an example (maybe just taking the Podman one? I wouldn't use the Docker one since it still suffers from the EPERM issue described in moby/moby#42871.).

cyphar

See my above comment.

"default" is misleading

AkihiroSuda · 2025-09-29T11:28:18Z

libcontainer/SPEC.md

+
+**Example seccomp profile:**
+An example seccomp profile based on Podman's default configuration is available at:
+[examples/seccomp/podman-default.json](../examples/seccomp/podman-default.json)


I don't think this JSON has to be put in the repo.
You can just put a hyperlink

Also, OCI seccomp is different from libcontainer seccomp.
See how it is converted here

runc/libcontainer/specconv/spec_linux.go

Line 1139 in 00aec12

func SetupSeccomp(config *specs.LinuxSeccomp) (*configs.Seccomp, error) {

yes, going to do that.

AkihiroSuda · 2025-09-29T12:22:20Z

libcontainer/SPEC.md

+Note: This is an OCI seccomp profile. Runc converts OCI seccomp profiles to libcontainer format
+using the `SetupSeccomp` function in `libcontainer/specconv/spec_linux.go`.
+
+**Example OCI seccomp format:**


A single example should suffice

rata

Thanks! Let's make the style more in-line with the rest of the file

libcontainer/SPEC.md

rata

Mostly LGTM now, thanks! Left an important question, though

rata · 2025-09-29T15:33:07Z

libcontainer/SPEC.md

+
+Seccomp can be used to filter the syscalls a container can use. The filter used is quite expressive. For example, a filter can allow only a syscall when used with a specific parameter is allowed, change the errno returned or even forward it to a user-space agent to act on it.
+
+Example OCI seccomp profile:


Have you tested this example?

yes, I built runc with seccomp tag, used runc spec then added that profile to it, and ran a container successfully.

libcontainer/SPEC.md

rata · 2025-09-30T11:53:05Z

libcontainer/SPEC.md

+The primary
+use-case is to provide an explicit allow-list of syscalls for a container, to


Line break is wrong here?

rata · 2025-09-30T11:53:32Z

libcontainer/SPEC.md

+libcontainer
+does not currently provide a default filter, but higher-level runtimes tend to


rata · 2025-09-30T11:54:04Z

libcontainer/SPEC.md

+libcontainer
+does not currently provide a default filter, but higher-level runtimes tend to
+define their own filters for use with runc. Here is an example OCI seccomp
+profile (see *the runtime specification* *oci-runtime-seccomp* for more


I guess this is intended to be a link but it's broken?

rata · 2025-09-30T11:55:26Z

libcontainer/SPEC.md

 ```

-*TODO: seccomp work is being done to find a good default config*
+**seccomp** can be used to apply filters to the system calls used in


Here you broke the link too.

What @cyphar showed with the [ ] is a markdown syntax to put links. You removed it, but we want it like that for the links :)

osamakader · 2025-09-30T12:26:12Z

Thanks @rata for the clarification.

osamakader · 2025-10-06T08:41:17Z

@cyphar changes are done.

AkihiroSuda · 2025-10-06T10:40:59Z

libcontainer/SPEC.md

+OCI seccomp profile (see
+[oci-runtime-seccomp](https://github.com/opencontainers/runtime-spec/blob/v1.2.1/config-linux.md#seccomp)
+for more information on how to write your own filters)



This PR no longer contains an example?

It refers only to the runtime spec example above only, yes.

I'm going to update the commit and PR messages.

Replace outdated TODO comment with updated information about runc's seccomp support. Signed-off-by: Osama Abdelkader <[email protected]>

AkihiroSuda previously approved these changes Sep 29, 2025

View reviewed changes

rata reviewed Sep 29, 2025

View reviewed changes

cyphar requested changes Sep 29, 2025

View reviewed changes

osamakader force-pushed the fix-outdated-seccomp-todo branch from b9cb4c8 to a221b17 Compare September 29, 2025 11:26

AkihiroSuda reviewed Sep 29, 2025

View reviewed changes

osamakader changed the title ~~docs: update outdated seccomp TODO comment~~ docs: add example seccomp profile based on Podman's default Sep 29, 2025

osamakader requested review from cyphar, rata and AkihiroSuda September 29, 2025 11:29

osamakader force-pushed the fix-outdated-seccomp-todo branch 2 times, most recently from 06ea960 to 43b3b58 Compare September 29, 2025 11:47

AkihiroSuda reviewed Sep 29, 2025

View reviewed changes

rata reviewed Sep 29, 2025

View reviewed changes

libcontainer/SPEC.md Outdated Show resolved Hide resolved

libcontainer/SPEC.md Outdated Show resolved Hide resolved

libcontainer/SPEC.md Outdated Show resolved Hide resolved

libcontainer/SPEC.md Outdated Show resolved Hide resolved

osamakader force-pushed the fix-outdated-seccomp-todo branch from 43b3b58 to f14c63e Compare September 29, 2025 14:31

osamakader requested a review from rata September 29, 2025 14:33

rata reviewed Sep 29, 2025

View reviewed changes

cyphar reviewed Sep 30, 2025

View reviewed changes

libcontainer/SPEC.md Outdated Show resolved Hide resolved

osamakader force-pushed the fix-outdated-seccomp-todo branch from f14c63e to f7e6cdc Compare September 30, 2025 11:24

osamakader requested a review from cyphar September 30, 2025 11:25

osamakader force-pushed the fix-outdated-seccomp-todo branch from f7e6cdc to 656677b Compare September 30, 2025 11:29

osamakader requested review from AkihiroSuda and rata September 30, 2025 11:34

rata reviewed Sep 30, 2025

View reviewed changes

osamakader force-pushed the fix-outdated-seccomp-todo branch from 656677b to 2fe8f87 Compare September 30, 2025 12:25

osamakader requested a review from rata September 30, 2025 12:26

AkihiroSuda reviewed Oct 6, 2025

View reviewed changes

docs: update seccomp documentation

e7ea570

Replace outdated TODO comment with updated information about runc's seccomp support. Signed-off-by: Osama Abdelkader <[email protected]>

osamakader force-pushed the fix-outdated-seccomp-todo branch from 2fe8f87 to e7ea570 Compare October 6, 2025 11:22

osamakader changed the title ~~docs: add example seccomp profile based on Podman's default~~ docs: update seccomp documentation Oct 6, 2025


		Seccomp can be used to filter the syscalls a container can use. The filter used is quite expressive. For example, a filter can allow only a syscall when used with a specific parameter is allowed, change the errno returned or even forward it to a user-space agent to act on it.

		Example OCI seccomp profile:

		The primary
		use-case is to provide an explicit allow-list of syscalls for a container, to

		libcontainer
		does not currently provide a default filter, but higher-level runtimes tend to

docs: update seccomp documentation #4902

Are you sure you want to change the base?

docs: update seccomp documentation #4902

Uh oh!

Conversation

osamakader commented Sep 26, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

cyphar left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

rata left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

rata left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

osamakader commented Sep 30, 2025

Uh oh!

osamakader commented Oct 6, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

osamakader commented Sep 26, 2025 •

edited

Loading