Question 1

How do I set up oci-seccomp-bpf-hook with Podman?

Accepted Answer

Install dependencies like bcc-devel and kernel-headers, then use the annotation io.containers.trace-syscall with input and output file paths in the podman run command, as shown in the README interface example. This requires running with sudo due to CAP_SYS_ADMIN.

Question 2

What are the security risks of using CAP_SYS_ADMIN with this hook?

Accepted Answer

CAP_SYS_ADMIN grants extensive system privileges, which could be exploited if the hook is compromised; it's best used in trusted environments and with proper isolation to avoid potential privilege escalation attacks.

Question 3

Is oci-seccomp-bpf-hook better than writing seccomp profiles manually?

Accepted Answer

For dynamic or complex applications, it automates profiling and reduces human error, but for static workloads, manual profiles might be simpler and offer more control without the overhead of eBPF tracing.

Question 4

How does the eBPF tracing work in this hook?

Accepted Answer

It spawns a child process that attaches an eBPF function to the raw_syscalls:sys_enter tracepoint, filters syscalls by the container's PID namespace, and writes them to a perf buffer for userspace processing to generate the profile.

Question 5

Can I use oci-seccomp-bpf-hook in Kubernetes?

Accepted Answer

Since it's an OCI hook, it can be integrated with container runtimes that support OCI hooks, but Kubernetes may require additional configuration and runtime support, which might not be straightforward out-of-the-box.

Question 6

What happens if a syscall is missed during tracing?

Accepted Answer

The generated profile will deny that syscall, potentially causing container failures; using a baseline input file can help include known necessary syscalls, but runtime behavior variations might still lead to issues.

oci-seccomp-bpf-hook

What is oci-seccomp-bpf-hook?

Overview

Use Cases

Best For

Related Projects

Found a gem we're missing?

Not Ideal For

Pros & Cons

Pros

Cons

Frequently Asked Questions