# Cis K8S V1110 5.7.2

> Ensure that the seccomp profile is set to docker/default in your pod definitions (Manual)

- Skill: `cyberstrikeus/cis-k8s-v1110-5-7-2` (Agent Skill)
- Install (CLI): `npx skillmds@latest add cyberstrikeus/cis-k8s-v1110-5-7-2`
- Raw SKILL.md: https://api.skillmd.com/api/skills/cyberstrikeus/cis-k8s-v1110-5-7-2/raw
- Safety review: PASS (external: skill-scanner PASS, skillspector PASS)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: DevOps & Infra
- Author: cyberstrikeus (https://skillmd.com/u/cyberstrikeus)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/cyberstrikeus/cis-k8s-v1110-5-7-2

---


# 5.7.2 Ensure that the seccomp profile is set to docker/default in your pod definitions (Manual)

## Profile Applicability

- Level 2 - Master Node

## Description

Enable `docker/default` seccomp profile in your pod definitions.

## Rationale

Seccomp (secure computing mode) is used to restrict the set of system calls applications can make, allowing cluster administrators greater control over the security of workloads running in the cluster. Kubernetes disables seccomp profiles by default for historical reasons. You should enable it to ensure that the workloads have restricted actions available within the container.

## Impact

If the `docker/default` seccomp profile is too restrictive for you, you would have to create/manage your own seccomp profiles.

## Audit

Review the pod definitions in your cluster. It should create a line as below:

```yaml
securityContext:
  seccompProfile:
    type: RuntimeDefault
```

## Remediation

Use security context to enable the `docker/default` seccomp profile in your pod definitions. An example is as below:

```yaml
securityContext:
  seccompProfile:
    type: RuntimeDefault
```

## Default Value

By default, seccomp profile is set to `unconfined` which means that no seccomp profiles are enabled.

## References

1. https://kubernetes.io/docs/tutorials/clusters/seccomp/
2. https://docs.docker.com/engine/security/seccomp/