Skip to content

Commit 7a2b047

Browse files
mikebrowmikebrow
committed
adds explanation for seccomp unset/unconfined default vs runtime default
Signed-off-by: Mike Brown <[email protected]>
1 parent 7d77b51 commit 7a2b047

1 file changed

Lines changed: 8 additions & 2 deletions

File tree

‎docs/cri/config.md‎

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -97,8 +97,14 @@ version = 2
9797
# when using containerd with Kubernetes <=1.11.
9898
disable_proc_mount = false
9999

100-
# unsetSeccompProfile is the profile containerd/cri will use if the provided seccomp profile is
101-
# unset (`""`) for a container (default is `unconfined`)
100+
# unset_seccomp_profile is the seccomp profile containerd/cri will use if the seccomp
101+
# profile requested over CRI is unset (or nil) for a pod/container (otherwise if this field is not set the
102+
# default unset profile will map to `unconfined`)
103+
# Note: The default unset seccomp profile should not be confused with the seccomp profile
104+
# used in CRI when the runtime default seccomp profile is requested. In the later case, the
105+
# default is set by the following code (https://github.com/containerd/containerd/blob/master/contrib/seccomp/seccomp_default.go).
106+
# To summarize, there are two different seccomp defaults, the unset default used when the CRI request is
107+
# set to nil or `unconfined`, and the default used when the runtime default seccomp profile is requested.
102108
unset_seccomp_profile = ""
103109

104110
# 'plugins."io.containerd.grpc.v1.cri".containerd' contains config related to containerd

0 commit comments

Comments
 (0)