CKS Practice Question 4: Seccomp Runtime Default Profile
Certified Kubernetes Security Specialist (CKS) · Test 1 · question 4 of 10
Your baseline requires every container in a new Deployment to run under the container runtime's default seccomp profile, so that dangerous syscalls are blocked without you having to author and distribute a custom profile to each node. The cluster runs Kubernetes v1.29.
Which change to the Pod template achieves this?
Show answer and explanation
Answer:
seccompProfile is a field of the security context, available at both Pod level (where it applies to all containers unless a container overrides it) and container level. Type RuntimeDefault tells the kubelet to apply the container runtime's own default profile, which ships with the runtime and needs no files on the node, exactly the requirement here. The other valid types are Localhost, which loads a profile file from the kubelet's seccomp root directory, and Unconfined, which applies no filtering at all.
Option A uses the alpha annotations, which were deprecated once the seccompProfile field graduated and were removed in v1.25. On a v1.29 cluster the annotation is inert metadata: the container would run unconfined while appearing to be protected.
Option C hardens privilege escalation, which is worthwhile, but has nothing to do with syscall filtering. Neither field causes a seccomp profile to be attached.
Option D is rejected at validation. localhostProfile must be set, and must not be set for any other type, when type: Localhost is used, so this Pod never gets created.
Reference: Restrict a Container's Syscalls with seccomp