See CRI sandbox annotations and libcontainer seccomp config.

@feiskyer I'd like to work on this if you aren't already. Few questions:

• k8s has a --seccomp-profile-root string flag, should we have the same in ocid to store/load seccomp profiles for pods/containers?
• where do we store the default seccomp profile for a given runtime? k8s can pass down to oci just runtime/default, but where do we get its content?
• https://github.com/kubernetes/kubernetes/blob/master/pkg/kubelet/api/v1alpha1/runtime/api.proto#L257, this may related to the first question, where the node's local seccomp profile root? some directory setup when starting ocid I guess, right?

@runcom Cool and good catch. Seccomp profile is indeed a problem, I think CRI should pass full path to runtimes instead of relative one. Filed kubernetes/kubernetes#36997 to fix this.

@runcom Cool and good catch. Seccomp profile is indeed a problem, I think CRI should pass full path to runtimes instead of relative one. Filed kubernetes/kubernetes#36997 to fix this.

thanks 👍 I'll follow that issue and when done, I'll implement it here in cri-o

@runcom We didn't get a consistent conclusion for kubernetes/kubernetes#36997, and the profile path will be a known issue in kubernetes 1.5, see here.

@runcom We didn't get a consistent conclusion for kubernetes/kubernetes#36997, and the profile path will be a known issue in kubernetes 1.5, see here.

@feiskyer thanks, I think we can still support runtime/default and unconfined though - correct me if I'm wrong (we'll follow https://github.com/opencontainers/runtime-spec/blob/master/config-linux.md#seccomp). Going to tackle this asap if we can at least use default and unconfined.

I think we can still support runtime/default and unconfined though

+1.

Let's leave this open until the upstream k8s issue about node's profiles is sorted out. @feiskyer could you change the title here?

@runcom renamed the title.

@runcom what is the state of this issue?

@rhatdan still blocked on kubernetes/kubernetes#46332

kubernetes/kubernetes#46332 has been merged for node-local seccomp profiles - however we are still waiting on a seccomp spec I guess kubernetes/kubernetes#39128

This is coming with kube 1.8 https://github.com/kubernetes/kubernetes/blob/v1.8.0-beta.1/pkg/kubelet/apis/cri/v1alpha1/runtime/api.proto#L217-L223