Container Runtime Security: seccomp, AppArmor, and EKS Pod Security
Quick summary: Default Docker seccomp is not enough for regulated workloads. EKS Pod Security Standards, seccomp profiles, and Fargate platform version constraints.
Key Takeaways
- EKS Pod Security Standards, seccomp profiles, and Fargate platform version constraints
- EKS Pod Security Standards (June 2026) enforce restricted baseline via namespace labels—blocks privileged pods, host namespaces, and dangerous volume types
- 2
- Scan top 10 images for
- 3
Table of Contents
EKS Pod Security Standards (June 2026) enforce restricted baseline via namespace labels—blocks privileged pods, host namespaces, and dangerous volume types.
seccomp / AppArmor
- seccomp: syscall filter (
RuntimeDefaultor custom profile JSON) - AppArmor: path-based MAC (less common on AL2/ Bottlerocket; SELinux on some AMIs)
Fargate restricts capabilities further—verify platform version release notes before requiring custom seccomp.
AWS map
| Control | Where |
|---|---|
| Admission | EKS PSS / OPA Gatekeeper / Kyverno |
| Image trust | ECR scanning + signing (Notation/Cosign) |
| Runtime threat | GuardDuty EKS protection |
What to do this week
- Label namespaces
pod-security.kubernetes.io/enforce=restricted. - Scan top 10 images for
CAP_SYS_ADMIN. - Document exceptions with security sign-off.
What this guide doesn’t cover
Network policies—see zero-trust VPC pattern.
PP
Palaniappan P
AWS Cloud Architect & AI Expert
AWS-certified cloud architect and AI expert with deep expertise in cloud migrations, cost optimization, and generative AI on AWS.
AWS ArchitectureCloud MigrationGenAI on AWSCost OptimizationDevOps
