---
title: Container Runtime Security: seccomp, AppArmor, and EKS Pod Security
description: Default Docker seccomp is not enough for regulated workloads. EKS Pod Security Standards, seccomp profiles, and Fargate platform version constraints.
url: https://www.joinhorizon.co/blog/container-runtime-security-seccomp-apparmor-eks-fargate/
datePublished: 2026-06-12T00:00:00.000Z
dateModified: 2026-10-28T00:00:00.000Z
author: manojkumar-varatharajan
category: DevOps & CI/CD
tags: engineering-guide, security, kubernetes, eks, aws
---

# Container Runtime Security: seccomp, AppArmor, and EKS Pod Security

> Default Docker seccomp is not enough for regulated workloads. EKS Pod Security Standards, seccomp profiles, and Fargate platform version constraints.

**EKS Pod Security Standards (June 2026)** enforce **restricted** baseline via namespace labels. They block privileged pods, host namespaces, and dangerous volume types.

> **Benchmark pattern (hypothetical workload):** EKS Pod Security Standards (restricted), seccomp RuntimeDefault blocks 94% of container breakout syscalls in Falco simulation; Fargate enforces platform seccomp, custom profile requires EKS managed node group.

## Symptom → mechanism → AWS control

| Production symptom               | Mechanism                        | AWS control                                            |
| -------------------------------- | -------------------------------- | ------------------------------------------------------ |
| Container escape via syscall     | Unrestricted syscall surface     | EKS Pod Security Standards restricted, seccomp profile |
| Privileged pod deployed          | No admission control             | OPA Gatekeeper / Kyverno deny privileged               |
| Fargate can't use custom seccomp | Fargate platform-managed runtime | EKS managed nodes for custom seccomp/AppArmor          |

**Opinionated take:** Enforce EKS Pod Security Standards 'restricted' in production namespaces. Fargate gives you platform seccomp free, but custom profiles need managed nodes.

## seccomp / AppArmor

- **seccomp**: syscall filter (`RuntimeDefault` or custom profile JSON)
- **AppArmor**: path-based MAC (less common on AL2/ Bottlerocket; SELinux on some AMIs)

**Fargate** restricts capabilities further, so verify platform version release notes before requiring custom seccomp.

## AWS services map

| Control        | Where                                    |
| -------------- | ---------------------------------------- |
| Admission      | EKS PSS / OPA Gatekeeper / Kyverno       |
| Image trust    | ECR scanning + signing (Notation/Cosign) |
| Runtime threat | GuardDuty EKS protection                 |

## What to do this week

1. Label namespaces `pod-security.kubernetes.io/enforce=restricted`.
2. Scan top 10 images for `CAP_SYS_ADMIN`.
3. Document exceptions with security sign-off.

## More in This Track

Part of the **Engineering Guides** library (June 2026).

- Previous: [Part 3](https://www.joinhorizon.co/blog/service-mesh-traffic-shifting-vpc-lattice-istio-eks/)
- Next: [Part 5](https://www.joinhorizon.co/blog/how-to-deploy-eks-karpenter-cost-optimized-autoscaling/)
- Browse tracks: [Engineering Guides hub](https://www.joinhorizon.co/resources/engineering-guides/)

## What this guide doesn't cover

Network policies: see zero-trust VPC pattern.

## FAQ

### When should I not use custom seccomp on EKS Fargate?
Fargate uses a platform-managed runtime. Custom seccomp or AppArmor profiles need EKS managed node groups. On Fargate, enforce Pod Security Standards restricted and accept platform seccomp. Do not assume a custom profile JSON will attach.

### Is RuntimeDefault seccomp enough for regulated workloads?
Default Docker seccomp is not enough by itself. Label production namespaces pod-security.kubernetes.io/enforce=restricted, deny privileged via Gatekeeper or Kyverno, and scan images for CAP_SYS_ADMIN. Restricted PSS blocks host namespaces and dangerous volumes.

### What could go wrong if a privileged pod still deploys?
PSS labels without admission webhooks can be bypassed by a namespace that is not labeled. Pair restricted PSS with OPA Gatekeeper or Kyverno deny-privileged, ECR signing, and GuardDuty EKS protection.

### Does this replace Kubernetes NetworkPolicy?
No. This guide covers syscall and pod-security controls. Network isolation is a different surface; see the zero-trust VPC pattern linked from this post.

---

*Source: https://www.joinhorizon.co/blog/container-runtime-security-seccomp-apparmor-eks-fargate/*