Skip to main content

​
Synopsis

Generate Seccomp profiles based on observed syscall usage. 
kubectl kguardian gen seccomp [POD_NAME] [flags]
kubectl kguardian gen secp [POD_NAME] [flags]  # Alias

​
Flags

FlagTypeDescriptionDefault
-n, --namespacestringNamespace of the podCurrent namespace
-a, --allboolGenerate for all pods in namespacefalse
-A, --all-namespacesboolGenerate for all pods cluster-widefalse
--output-dirstringDirectory to save profilesseccomp-profiles
--default-actionstringAction for unlisted syscallsSCMP_ACT_ERRNO

​
Default Actions

  • SCMP_ACT_ERRNO - Return error for unlisted syscalls (recommended)
  • SCMP_ACT_LOG - Log unlisted syscalls but allow them (audit mode)
  • SCMP_ACT_KILL - Kill process on unlisted syscall (strictest)

​
Examples

# Single pod
kubectl kguardian gen seccomp my-app -n prod --output-dir ./seccomp

# All pods with logging for unlisted
kubectl kguardian gen secp --all -n staging --default-action SCMP_ACT_LOG

# Cluster-wide with strict mode
kubectl kguardian gen secp -A --default-action SCMP_ACT_KILL
See Generating Seccomp Profiles for detailed usage.