Container runtime security policies (seccomp, AppArmor) are applied

Without seccomp or AppArmor profiles, containers can make any Linux system call — including ptrace, mount, kexec, and others that have no role in application logic but are used in known container escape exploits (NIST 800-53 CM-7, CIS Kubernetes 5.7.2/5.7.3). Seccomp RuntimeDefault blocks over 300 system calls not used by typical applications, reducing the kernel attack surface measurably. Unconfined profiles explicitly disable all restrictions and are categorically worse than the default — any container with Unconfined is actively regressing security below Kubernetes defaults.

Apply seccompProfile: RuntimeDefault to all containers that do not require custom syscall access. In your Deployment manifest:

spec:
  template:
    spec:
      securityContext:
        seccompProfile:
          type: RuntimeDefault
      containers:
        - name: app
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
                - ALL

RuntimeDefault uses the container runtime's built-in seccomp policy (Docker/containerd both ship sensible defaults). For workloads with custom syscall requirements, generate a profile with docker run --security-opt seccomp=unconfined --cap-drop=ALL to observe actual syscall usage, then build a Localhost profile. For AppArmor, annotate pods with container.apparmor.security.beta.kubernetes.io/<container>: runtime/default.