From c0e267224390aacfa4b2917f39b8018cefda39ad Mon Sep 17 00:00:00 2001
From: Benjamin Leggett <benjamin@edera.io>
Date: Tue, 14 Jul 2026 18:35:36 -0400
Subject: [PATCH] feat(control): add seccomp profile stuff

---
 protect/control/v1/common.proto | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/protect/control/v1/common.proto b/protect/control/v1/common.proto
index 5973de1..1a2f771 100644
--- a/protect/control/v1/common.proto
+++ b/protect/control/v1/common.proto
@@ -453,6 +453,15 @@ message WorkloadScratchMount {
   string path = 1;
 }
 
+enum SeccompProfileType {
+  // No seccomp filter (also the default when unset).
+  SECCOMP_PROFILE_TYPE_UNCONFINED = 0;
+  // The runtime's built-in default profile.
+  SECCOMP_PROFILE_TYPE_RUNTIME_DEFAULT = 1;
+  // A profile loaded from a file on the node (see seccomp_localhost_ref).
+  SECCOMP_PROFILE_TYPE_LOCALHOST = 2;
+}
+
 message WorkloadSecuritySpec {
   bool strict_user_namespace = 1;
   repeated string raise_capabilities = 2;
@@ -463,6 +472,10 @@ message WorkloadSecuritySpec {
   repeated ProcessNamespace disable_namespaces = 7;
   bool read_only_rootfs = 8;
   bool no_new_privs = 9;
+  SeccompProfileType seccomp_profile_type = 10;
+  // Path to the localhost seccomp profile, relative to the kubelet seccomp
+  // root; set only when seccomp_profile_type == SECCOMP_PROFILE_TYPE_LOCALHOST.
+  string seccomp_localhost_ref = 11;
 }
 
 enum WorkloadState {