From 61b8cafa845d541d2f0688a059defa05ac684c4d Mon Sep 17 00:00:00 2001 From: Sascha Grunert Date: Fri, 20 Aug 2021 10:04:43 +0200 Subject: [PATCH] Mention that privileged containers run unconfined This is a note which helps users to understand the interaction between privileged containers and seccomp profiles. Signed-off-by: Sascha Grunert Co-authored-by: Tim Bannister --- content/en/docs/tutorials/clusters/seccomp.md | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/content/en/docs/tutorials/clusters/seccomp.md b/content/en/docs/tutorials/clusters/seccomp.md index c510f4c707..029ea97a7d 100644 --- a/content/en/docs/tutorials/clusters/seccomp.md +++ b/content/en/docs/tutorials/clusters/seccomp.md @@ -46,6 +46,12 @@ make sure that your cluster is [configured correctly](https://kind.sigs.k8s.io/docs/user/quick-start/#setting-kubernetes-version) for the version you are using. +{{< note >}} +It is not possible to apply a seccomp profile to a container running with +`privileged: true` set in the container's `securityContext`. Privileged containers always +run as `Unconfined`. +{{< /note >}} + ## Enable the use of `RuntimeDefault` as the default seccomp profile for all workloads