Metadata

Id: dockercompose-default-seccomp-profile-disabled

Platform: DockerCompose

Severity: Medium

Category: Resource Management

Learn More

• Provider Reference

Description

The default seccomp (secure computing mode) profile restricts the set of Linux system calls available to a container, significantly reducing the attack surface if the container is compromised. Setting seccomp:unconfined in security_opt disables this protection entirely, allowing container processes to invoke any system call the kernel supports. Services should not include seccomp:unconfined in their security_opt list unless there is a specific, documented justification.

Compliant Code Examples

services:
  profile:
    image: alpine
    security_opt: [seccomp:/profiles/unconfined.json]
  lookalike:
    image: alpine
    security_opt: [seccomp:unconfined-extra]
  default:
    image: alpine

Non-Compliant Code Examples

services:
  colon:
    image: alpine
    security_opt: [seccomp:unconfined]
  equal:
    image: alpine
    security_opt: [seccomp=unconfined]