Skip to content

feat(control): add seccomp profile stuff #43

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
bleggett merged 1 commit into from
Jul 15, 2026
Merged

feat(control): add seccomp profile stuff #43

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
13 changes: 13 additions & 0 deletions protect/control/v1/common.proto
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -453,6 +453,15 @@ message WorkloadScratchMount {
string path = 1;
}

enum SeccompProfileType {
// No seccomp filter (also the default when unset).
SECCOMP_PROFILE_TYPE_UNCONFINED = 0;
// The runtime's built-in default profile.
SECCOMP_PROFILE_TYPE_RUNTIME_DEFAULT = 1;
// A profile loaded from a file on the node (see seccomp_localhost_ref).
SECCOMP_PROFILE_TYPE_LOCALHOST = 2;
}

message WorkloadSecuritySpec {
bool strict_user_namespace = 1;
repeated string raise_capabilities = 2;
Expand All @@ -463,6 +472,10 @@ message WorkloadSecuritySpec {
repeated ProcessNamespace disable_namespaces = 7;
bool read_only_rootfs = 8;
bool no_new_privs = 9;
SeccompProfileType seccomp_profile_type = 10;
// Path to the localhost seccomp profile, relative to the kubelet seccomp
// root; set only when seccomp_profile_type == SECCOMP_PROFILE_TYPE_LOCALHOST.
string seccomp_localhost_ref = 11;
}

enum WorkloadState {
Expand Down
Loading