Container Runtime Security: seccomp, AppArmor, and EKS Pod Security
Quick summary: Default Docker seccomp is not enough for regulated workloads. EKS Pod Security Standards, seccomp profiles, and Fargate platform version constraints.
Key Takeaways
- EKS Pod Security Standards, seccomp profiles, and Fargate platform version constraints
- EKS Pod Security Standards (June 2026) enforce restricted baseline via namespace labels—blocks privileged pods, host namespaces, and dangerous volume types
- 2
- Scan top 10 images for
- 3
Table of Contents
EKS Pod Security Standards (June 2026) enforce restricted baseline via namespace labels—blocks privileged pods, host namespaces, and dangerous volume types.
Benchmark pattern (hypothetical workload) — EKS Pod Security Standards (restricted), seccomp RuntimeDefault blocks 94% of container breakout syscalls in Falco simulation; Fargate enforces platform seccomp, custom profile requires EKS managed node group.
Symptom → mechanism → AWS control
| Production symptom | Mechanism | AWS control |
|---|---|---|
| Container escape via syscall | Unrestricted syscall surface | EKS Pod Security Standards restricted, seccomp profile |
| Privileged pod deployed | No admission control | OPA Gatekeeper / Kyverno deny privileged |
| Fargate can’t use custom seccomp | Fargate platform-managed runtime | EKS managed nodes for custom seccomp/AppArmor |
Opinionated take: Enforce EKS Pod Security Standards ‘restricted’ in production namespaces—Fargate gives you platform seccomp free, but custom profiles need managed nodes.
seccomp / AppArmor
- seccomp: syscall filter (
RuntimeDefaultor custom profile JSON) - AppArmor: path-based MAC (less common on AL2/ Bottlerocket; SELinux on some AMIs)
Fargate restricts capabilities further—verify platform version release notes before requiring custom seccomp.
AWS services map
| Control | Where |
|---|---|
| Admission | EKS PSS / OPA Gatekeeper / Kyverno |
| Image trust | ECR scanning + signing (Notation/Cosign) |
| Runtime threat | GuardDuty EKS protection |
What to do this week
- Label namespaces
pod-security.kubernetes.io/enforce=restricted. - Scan top 10 images for
CAP_SYS_ADMIN. - Document exceptions with security sign-off.
More in This Track
Part of the Engineering Guides library (June 2026).
- Previous: Part 3
- Next: Part 5
- Browse tracks: Engineering Guides hub
What this guide doesn’t cover
Network policies—see zero-trust VPC pattern.
AWS Cloud Architect & AI Expert
AWS-certified cloud architect and AI expert with deep expertise in cloud migrations, cost optimization, and generative AI on AWS.
