File tree Expand file tree Collapse file tree 1 file changed +3
-4
lines changed
content/en/docs/tutorials/clusters Expand file tree Collapse file tree 1 file changed +3
-4
lines changed Original file line number Diff line number Diff line change @@ -342,17 +342,16 @@ syscalls. Here seccomp has been instructed to error on any syscall by setting
342
342
ability to do anything meaningful. What you really want is to give workloads
343
343
only the privileges they need.
344
344
345
- Clean up that Pod and Service before moving to the next section:
345
+ Clean up that Pod before moving to the next section:
346
346
347
347
``` shell
348
- kubectl delete service violation-pod --wait
349
348
kubectl delete pod violation-pod --wait --now
350
349
```
351
350
352
351
## Create Pod with seccomp profile that only allows necessary syscalls
353
352
354
- If you take a look at the ` fine-pod .json ` , you will notice some of the syscalls
355
- seen in the first example where the profile set `"defaultAction":
353
+ If you take a look at the ` fine-grained .json ` profile , you will notice some of the syscalls
354
+ seen in syslog of the first example where the profile set `"defaultAction":
356
355
"SCMP_ACT_LOG"` . Now the profile is setting ` "defaultAction": "SCMP_ACT_ERRNO"`,
357
356
but explicitly allowing a set of syscalls in the ` "action": "SCMP_ACT_ALLOW" `
358
357
block. Ideally, the container will run successfully and you will see no messages
You can’t perform that action at this time.
0 commit comments