Custom seccomp Profiles with Inspektor Gadget
summary
Inspektor Gadget uses eBPF to trace every system call a containerized application makes over its lifecycle and then generates a compact seccomp profile that blocks unexpected calls such as exec or fork while allowing the traced calls. The talk demonstrates two traces—a minimal run with few syscalls and a run including init where the syscall list grows—shows automatic installation via the Security Profile Operator, and notes that monitoring must start at process boot to capture boot-time syscalls.
AI-written summary · about
chapters (18)
- 0:00Introduction
- 2:49What is seccomp
- 5:19Strict vs filter modes
- 7:23Seccomp in Kubernetes
- 10:13Custom profile structure
- 12:27Inspektor Gadget overview
- 14:59Gadget architecture
- 17:30Available gadgets
- 19:42Seccomp gadget: monitoring & profiling
- 21:43Installing Inspektor Gadget
- 23:53Deploying seccomp gadget
- 26:50Preparing test app
- 27:33Monitoring syscalls
- 28:38Generating seccomp profile
- 30:04Integration with SPO
- 32:38Applying profile to pod
- 34:03Verifying protection
- 35:22Closing & open source
related talks
10mGenerating seccomp policies with eBPF
26mReinventing Seccomp for Fun and Profiles
20mGenerate seccomp profiles for containers using bpf
40mUsing the EBPF Superpowers To Generate Kubernetes Security Policies
34mSeccomp: What Can It Do For You?
43mSandboxes, Seccomp, and Syscalls: Chasing Isolation in Kubernetes (Mark Manning)
32mSecuring Kubernetes Applications by Crafting Custom Seccomp Profiles
44mSeccomp for Developers - Making Applications Simply More Secure