> Markdown version of [/videos/356-enhancing-workload-security-in-kubernetes?t=723](https://www.wearedevelopers.com/videos/356-enhancing-workload-security-in-kubernetes?t=723). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# Enhancing Workload Security in Kubernetes

Think your read-only file systems stop advanced threats? Learn how to defeat fileless malware using kernel-level protections like Seccomp and the Security Profiles Operator in Kubernetes.

- **Speakers:** Dimitrij Klesev, Andreas Zeissner
- **Event:** WeAreDevelopers LIVE
- **Published:** February 24, 2022
- **Duration:** 44:00
- **URL:** https://www.wearedevelopers.com/videos/356-enhancing-workload-security-in-kubernetes

## Summary

Enhancing Kubernetes workload security requires moving beyond basic container configurations to leverage advanced kernel-level protections. Foundational hardening begins within the pod's `securityContext`, where administrators enforce the principle of least privilege by dropping unnecessary capabilities, running containers as non-root, and mounting read-only file systems. However, advanced threats like fileless malware can circumvent read-only restrictions by executing binary payloads purely in memory. Mitigating these attacks requires deploying Seccomp to explicitly deny unnecessary system calls, such as `memfd_create`, thereby drastically reducing the kernel attack surface available to unauthorized processes.

Beyond system call filtering, integrating Linux Security Modules (LSM) like AppArmor and SELinux provides deeper defense-in-depth through Mandatory Access Control (MAC). Unlike standard Discretionary Access Control (DAC), MAC rigidly defines read, write, and execution boundaries for containerized processes, preventing lateral movement even if a pod shares internal volumes. Operators can utilize specific profile languages or tools like `audit2allow` to generate granular SELinux profiles based on system events. While SELinux enforces a robust labeling system—often assigning applications a `container_t` context—fine-tuning these constraints ensures that isolated workloads cannot arbitrarily access host resources or sensitive directories.

A primary challenge in scaling MAC and Seccomp enforcement is distributing security profiles across all Kubernetes worker nodes. The Security Profiles Operator resolves this friction by enabling policy-as-code deployments directly through Kubernetes Custom Resources. Instead of relying on manual operational tooling or node-level provisioning, the operator synchronizes profiles across the cluster and securely attaches them to specific deployments via profile bindings. Furthermore, the operator enhances observability by functioning as a log enricher, translating kernel-level AVC messages and audit logs into Prometheus metrics to quickly identify and alert on internal security violations or blocked syscalls.

**Keywords:** kubernetes security context, seccomp syscall filtering, linux security modules, apparmor policy enforcement, selinux access control, security profiles operator, fileless malware mitigation, mandatory access control, discretionary access control, ebpf kernel inspection, audit2allow policy generation, kubernetes log enrichment, container least privilege, avc audit logging, system call restriction

## Chapters

1. **Introduction to Kubernetes security context configurations** (00:02) — Pod and container specifications can be configured to restrict capabilities, users, and file system access.
1. **Restricting system calls with Seccomp profiles** (03:46) — Applying the least privilege principle mitigates exploits by explicitly denying unnecessary system calls to the kernel.
1. **Extending mandatory access control with AppArmor** (07:31) — AppArmor enables mandatory access control to restrict file access and process isolation across containers sharing a volume.
1. **Tightening the security perimeter using SELinux** (12:03) — SELinux acts as kernel middleware to enforce fine-grained access contexts between subjects and objects.
1. **Automating policies via the Security Profiles Operator** (17:48) — The Security Profiles Operator automates the deployment and management of security module bindings using unified YAML configurations.
1. **Deploying manual Seccomp profiles to block malware** (19:54) — Simulating fileless malware execution in memory demonstrates the necessity of denying specific memory allocation system calls.
1. **Automating Seccomp rules with operator profile bindings** (25:06) — Profile bindings allow administrators to apply Seccomp rules globally without managing static files locally on every node.
1. **Troubleshooting SELinux container permission denials live** (28:20) — Generating custom SELinux policies live helps resolve application directory access denials and permission errors.
1. **Handling container constraints and fileless malware** (37:58) — Audience questions cover granular AppArmor constraints, fileless malware execution techniques, and eBPF as modern kernel middleware.

## Related Moments

- [Introduction to Kubernetes security challenges and opportunities](https://www.wearedevelopers.com/videos/412-kubernetes-security-challenge-and-opportunity) (from "Kubernetes Security - Challenge and Opportunity")
- [Securing Kubernetes workloads and containerized image layers](https://www.wearedevelopers.com/videos/242-microservices-how-to-get-started-with-spring-boot-and-kubernetes) (from "Microservices: how to get started with Spring Boot and Kubernetes")
- [Applying capability constraints in Kubernetes pod specifications](https://www.wearedevelopers.com/videos/718-turning-container-security-up-to-11-with-capabilities) (from "Turning Container security up to 11 with Capabilities")
- [Mitigating container escalation paths using system call filters](https://www.wearedevelopers.com/videos/362-security-challenges-of-breaking-a-monolith) (from "Security Challenges of Breaking A Monolith")
- [Assessing common Kubernetes security incidents and misconfigurations](https://www.wearedevelopers.com/videos/1411-kubernetes-security-best-practices) (from "Kubernetes Security Best Practices")
- [Audience questions on security, limitations, and Kubernetes crossover](https://www.wearedevelopers.com/videos/732-kubernetes-dev-is-fun-but-setup-and-ops-isn-t-see-a-fun-paas-alternative-to-push-any-code-ipynbs-or-even-just-data) (from "Kubernetes dev is fun, but setup and ops isn't! See a fun PaaS alternative to push any code, ipynbs or even just data!")

## Related Articles

- [Learning Kubernetes made easy with KubeCampus](https://www.wearedevelopers.com/magazine/348-learning-kubernetes-made-easy-with-kubecampus)
- [Walking Into The Era of Supply Chain Risks](https://www.wearedevelopers.com/magazine/106-walking-into-the-era-of-supply-chain-risks)
- [Dev Digest 138 - Are you secure about this?](https://www.wearedevelopers.com/magazine/486-dev-digest-138-are-you-secure-about-this)
- [Events like RSAC Get You CISOs. Developers Decide What Actually Gets Deployed.](https://www.wearedevelopers.com/magazine/693-events-like-rsac-get-you-cisos-developers-decide-what-actually-gets-deployed)

## Related Jobs

- [Lead Cloud DevSecOps Engineer - Kubernetes](https://www.wearedevelopers.com/jobs/ext/1659167-lead-cloud-devsecops-engineer-kubernetes) at **BWI GmbH**
- [Platform Engineer (DevOps)](https://www.wearedevelopers.com/jobs/48264-platform-engineer-devops) at **WDW Consulting GmbH**
- [Staff Developer Advocate, GitHub Security Lab](https://www.wearedevelopers.com/jobs/ext/1921051-staff-developer-advocate-github-security-lab) at **GitHub**
- [Endpoint Security Engineer - OT](https://www.wearedevelopers.com/jobs/ext/1306782-endpoint-security-engineer-ot) at **ZEISS Group**
- [Endpoint Security Engineer - OT](https://www.wearedevelopers.com/jobs/ext/1998712-endpoint-security-engineer-ot) at **ZEISS Group**
- [Endpoint Security Engineer](https://www.wearedevelopers.com/jobs/ext/1962698-endpoint-security-engineer) at **ZEISS Group**