{"action":"created","comment":{"url":"https://api.github.com/repos/docker/docker/pulls/comments/48699038","id":48699038,"diff_hunk":"@@ -3,27 +3,25 @@\n title = \"Seccomp security profiles for Docker\"\n description = \"Enabling seccomp in Docker\"\n keywords = [\"seccomp, security, docker, documentation\"]\n+[menu.main]\n+parent= \"smn_secure_docker\"\n +++\n <![end-metadata]-->\n \n-Seccomp security profiles for Docker\n-------------------------------------\n+# Seccomp security profiles for Docker\n \n-The seccomp() system call operates on the Secure Computing (seccomp)\n-state of the calling process.\n+Secure computing mode (Seccomp) is a Linux kernel feature. You can use it to\n+restrict the actions available within the container.  The `seccomp()`\n+system call operates on the seccomp state of the calling process. You can use this feature to restrict the access of your application.  \n \n-This operation is available only if the kernel is configured\n-with `CONFIG_SECCOMP` enabled.\n+This feature is available only if the kernel is configured\n+with `CONFIG_SECCOMP` enabled.  \n \n-This allows for allowing or denying of certain syscalls in a container.\n+## Passing a profile for a container\n \n-Passing a profile for a container\n----------------------------------\n-\n-Users may pass a seccomp profile using the `security-opt` option\n-(per-container).\n-\n-The profile has layout in the following form:\n+The default seccomp profile provides a sane default for running containers with\n+seccomp. It is moderately protective while providing wide application\n+compatibility. The default Docker profile has layout in the following form:","path":"docs/security/seccomp.md","position":36,"original_position":36,"commit_id":"b7eb12e361e870a4522bc745315547bdc4bfad71","original_commit_id":"b7eb12e361e870a4522bc745315547bdc4bfad71","user":{"login":"jfrazelle","id":1445228,"avatar_url":"https://avatars.githubusercontent.com/u/1445228?v=3","gravatar_id":"","url":"https://api.github.com/users/jfrazelle","html_url":"https://github.com/jfrazelle","followers_url":"https://api.github.com/users/jfrazelle/followers","following_url":"https://api.github.com/users/jfrazelle/following{/other_user}","gists_url":"https://api.github.com/users/jfrazelle/gists{/gist_id}","starred_url":"https://api.github.com/users/jfrazelle/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jfrazelle/subscriptions","organizations_url":"https://api.github.com/users/jfrazelle/orgs","repos_url":"https://api.github.com/users/jfrazelle/repos","events_url":"https://api.github.com/users/jfrazelle/events{/privacy}","received_events_url":"https://api.github.com/users/jfrazelle/received_events","type":"User","site_admin":false},"body":"The user can decide either way, if a custom profile is run we don't use the default profile\n\n\nOn Jan 3, 2016, 15:47 -0800, Sebastiaan van Stijn<notifications@github.com>, wrote:\n>  \n> Indocs/security/seccomp.md(https://github.com/docker/docker/pull/18452#discussion_r48698986):\n>  \n> >>-Passing a profile for a container>---------------------------------->->-Users may pass a seccomp profile using the `security-opt` option>-(per-container).>->-The profile has layout in the following form:>+The default seccomp profile provides a sane default for running containers with>+seccomp. It is moderately protective while providing wide application>+compatibility. The default Docker profile has layout in the following form:\n>  \n> @jfrazelle(https://github.com/jfrazelle)does the example format below need to be updated if we switch to a whitelist? (#18979(https://github.com/docker/docker/pull/18979)), I.e. will\"defaultAction\": \"SCMP_ACT_ALLOW\"be a \"deny\"?\n>  \n>  \n> —\n> Reply to this email directly orview it on GitHub(https://github.com/docker/docker/pull/18452/files#r48698986).\n>  \n>  \n>  \n\n\n","created_at":"2016-01-03T23:49:36Z","updated_at":"2016-01-03T23:49:36Z","html_url":"https://github.com/docker/docker/pull/18452#discussion_r48699038","pull_request_url":"https://api.github.com/repos/docker/docker/pulls/18452","_links":{"self":{"href":"https://api.github.com/repos/docker/docker/pulls/comments/48699038"},"html":{"href":"https://github.com/docker/docker/pull/18452#discussion_r48699038"},"pull_request":{"href":"https://api.github.com/repos/docker/docker/pulls/18452"}}},"pull_request":{"url":"https://api.github.com/repos/docker/docker/pulls/18452","id":52758419,"html_url":"https://github.com/docker/docker/pull/18452","diff_url":"https://github.com/docker/docker/pull/18452.diff","patch_url":"https://github.com/docker/docker/pull/18452.patch","issue_url":"https://api.github.com/repos/docker/docker/issues/18452","number":18452,"state":"open","locked":false,"title":"Update security docs for seccomp/apparmor","user":{"login":"moxiegirl","id":1347209,"avatar_url":"https://avatars.githubusercontent.com/u/1347209?v=3","gravatar_id":"","url":"https://api.github.com/users/moxiegirl","html_url":"https://github.com/moxiegirl","followers_url":"https://api.github.com/users/moxiegirl/followers","following_url":"https://api.github.com/users/moxiegirl/following{/other_user}","gists_url":"https://api.github.com/users/moxiegirl/gists{/gist_id}","starred_url":"https://api.github.com/users/moxiegirl/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/moxiegirl/subscriptions","organizations_url":"https://api.github.com/users/moxiegirl/orgs","repos_url":"https://api.github.com/users/moxiegirl/repos","events_url":"https://api.github.com/users/moxiegirl/events{/privacy}","received_events_url":"https://api.github.com/users/moxiegirl/received_events","type":"User","site_admin":false},"body":"Carry of docs for: #17989 \r\n\r\nSigned-off-by: Mary Anthony <mary@docker.com>","created_at":"2015-12-05T16:39:53Z","updated_at":"2016-01-03T23:49:36Z","closed_at":null,"merged_at":null,"merge_commit_sha":"95dbe529b5da3e4e0c61d42eeea1318927c27bf5","assignee":null,"milestone":{"url":"https://api.github.com/repos/docker/docker/milestones/44","html_url":"https://github.com/docker/docker/milestones/1.10","labels_url":"https://api.github.com/repos/docker/docker/milestones/44/labels","id":1351533,"number":44,"title":"1.10","description":"","creator":{"login":"thaJeztah","id":1804568,"avatar_url":"https://avatars.githubusercontent.com/u/1804568?v=3","gravatar_id":"","url":"https://api.github.com/users/thaJeztah","html_url":"https://github.com/thaJeztah","followers_url":"https://api.github.com/users/thaJeztah/followers","following_url":"https://api.github.com/users/thaJeztah/following{/other_user}","gists_url":"https://api.github.com/users/thaJeztah/gists{/gist_id}","starred_url":"https://api.github.com/users/thaJeztah/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/thaJeztah/subscriptions","organizations_url":"https://api.github.com/users/thaJeztah/orgs","repos_url":"https://api.github.com/users/thaJeztah/repos","events_url":"https://api.github.com/users/thaJeztah/events{/privacy}","received_events_url":"https://api.github.com/users/thaJeztah/received_events","type":"User","site_admin":false},"open_issues":25,"closed_issues":63,"state":"open","created_at":"2015-10-12T18:21:55Z","updated_at":"2016-01-03T23:49:07Z","due_on":null,"closed_at":null},"commits_url":"https://api.github.com/repos/docker/docker/pulls/18452/commits","review_comments_url":"https://api.github.com/repos/docker/docker/pulls/18452/comments","review_comment_url":"https://api.github.com/repos/docker/docker/pulls/comments{/number}","comments_url":"https://api.github.com/repos/docker/docker/issues/18452/comments","statuses_url":"https://api.github.com/repos/docker/docker/statuses/b7eb12e361e870a4522bc745315547bdc4bfad71","head":{"label":"moxiegirl:carrry-doc-17989","ref":"carrry-doc-17989","sha":"b7eb12e361e870a4522bc745315547bdc4bfad71","user":{"login":"moxiegirl","id":1347209,"avatar_url":"https://avatars.githubusercontent.com/u/1347209?v=3","gravatar_id":"","url":"https://api.github.com/users/moxiegirl","html_url":"https://github.com/moxiegirl","followers_url":"https://api.github.com/users/moxiegirl/followers","following_url":"https://api.github.com/users/moxiegirl/following{/other_user}","gists_url":"https://api.github.com/users/moxiegirl/gists{/gist_id}","starred_url":"https://api.github.com/users/moxiegirl/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/moxiegirl/subscriptions","organizations_url":"https://api.github.com/users/moxiegirl/orgs","repos_url":"https://api.github.com/users/moxiegirl/repos","events_url":"https://api.github.com/users/moxiegirl/events{/privacy}","received_events_url":"https://api.github.com/users/moxiegirl/received_events","type":"User","site_admin":false},"repo":{"id":38079763,"name":"docker","full_name":"moxiegirl/docker","owner":{"login":"moxiegirl","id":1347209,"avatar_url":"https://avatars.githubusercontent.com/u/1347209?v=3","gravatar_id":"","url":"https://api.github.com/users/moxiegirl","html_url":"https://github.com/moxiegirl","followers_url":"https://api.github.com/users/moxiegirl/followers","following_url":"https://api.github.com/users/moxiegirl/following{/other_user}","gists_url":"https://api.github.com/users/moxiegirl/gists{/gist_id}","starred_url":"https://api.github.com/users/moxiegirl/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/moxiegirl/subscriptions","organizations_url":"https://api.github.com/users/moxiegirl/orgs","repos_url":"https://api.github.com/users/moxiegirl/repos","events_url":"https://api.github.com/users/moxiegirl/events{/privacy}","received_events_url":"https://api.github.com/users/moxiegirl/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/moxiegirl/docker","description":"Docker - the open-source application container engine","fork":true,"url":"https://api.github.com/repos/moxiegirl/docker","forks_url":"https://api.github.com/repos/moxiegirl/docker/forks","keys_url":"https://api.github.com/repos/moxiegirl/docker/keys{/key_id}","collaborators_url":"https://api.github.com/repos/moxiegirl/docker/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/moxiegirl/docker/teams","hooks_url":"https://api.github.com/repos/moxiegirl/docker/hooks","issue_events_url":"https://api.github.com/repos/moxiegirl/docker/issues/events{/number}","events_url":"https://api.github.com/repos/moxiegirl/docker/events","assignees_url":"https://api.github.com/repos/moxiegirl/docker/assignees{/user}","branches_url":"https://api.github.com/repos/moxiegirl/docker/branches{/branch}","tags_url":"https://api.github.com/repos/moxiegirl/docker/tags","blobs_url":"https://api.github.com/repos/moxiegirl/docker/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/moxiegirl/docker/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/moxiegirl/docker/git/refs{/sha}","trees_url":"https://api.github.com/repos/moxiegirl/docker/git/trees{/sha}","statuses_url":"https://api.github.com/repos/moxiegirl/docker/statuses/{sha}","languages_url":"https://api.github.com/repos/moxiegirl/docker/languages","stargazers_url":"https://api.github.com/repos/moxiegirl/docker/stargazers","contributors_url":"https://api.github.com/repos/moxiegirl/docker/contributors","subscribers_url":"https://api.github.com/repos/moxiegirl/docker/subscribers","subscription_url":"https://api.github.com/repos/moxiegirl/docker/subscription","commits_url":"https://api.github.com/repos/moxiegirl/docker/commits{/sha}","git_commits_url":"https://api.github.com/repos/moxiegirl/docker/git/commits{/sha}","comments_url":"https://api.github.com/repos/moxiegirl/docker/comments{/number}","issue_comment_url":"https://api.github.com/repos/moxiegirl/docker/issues/comments{/number}","contents_url":"https://api.github.com/repos/moxiegirl/docker/contents/{+path}","compare_url":"https://api.github.com/repos/moxiegirl/docker/compare/{base}...{head}","merges_url":"https://api.github.com/repos/moxiegirl/docker/merges","archive_url":"https://api.github.com/repos/moxiegirl/docker/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/moxiegirl/docker/downloads","issues_url":"https://api.github.com/repos/moxiegirl/docker/issues{/number}","pulls_url":"https://api.github.com/repos/moxiegirl/docker/pulls{/number}","milestones_url":"https://api.github.com/repos/moxiegirl/docker/milestones{/number}","notifications_url":"https://api.github.com/repos/moxiegirl/docker/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/moxiegirl/docker/labels{/name}","releases_url":"https://api.github.com/repos/moxiegirl/docker/releases{/id}","created_at":"2015-06-25T23:27:51Z","updated_at":"2015-06-25T23:27:58Z","pushed_at":"2016-01-03T23:30:09Z","git_url":"git://github.com/moxiegirl/docker.git","ssh_url":"git@github.com:moxiegirl/docker.git","clone_url":"https://github.com/moxiegirl/docker.git","svn_url":"https://github.com/moxiegirl/docker","homepage":"http://www.docker.com","size":78941,"stargazers_count":0,"watchers_count":0,"language":"Go","has_issues":false,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":0,"mirror_url":null,"open_issues_count":1,"forks":0,"open_issues":1,"watchers":0,"default_branch":"master"}},"base":{"label":"docker:master","ref":"master","sha":"2916ceb31376cc7ed92f87d7ff413b0dad82b984","user":{"login":"docker","id":5429470,"avatar_url":"https://avatars.githubusercontent.com/u/5429470?v=3","gravatar_id":"","url":"https://api.github.com/users/docker","html_url":"https://github.com/docker","followers_url":"https://api.github.com/users/docker/followers","following_url":"https://api.github.com/users/docker/following{/other_user}","gists_url":"https://api.github.com/users/docker/gists{/gist_id}","starred_url":"https://api.github.com/users/docker/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/docker/subscriptions","organizations_url":"https://api.github.com/users/docker/orgs","repos_url":"https://api.github.com/users/docker/repos","events_url":"https://api.github.com/users/docker/events{/privacy}","received_events_url":"https://api.github.com/users/docker/received_events","type":"Organization","site_admin":false},"repo":{"id":7691631,"name":"docker","full_name":"docker/docker","owner":{"login":"docker","id":5429470,"avatar_url":"https://avatars.githubusercontent.com/u/5429470?v=3","gravatar_id":"","url":"https://api.github.com/users/docker","html_url":"https://github.com/docker","followers_url":"https://api.github.com/users/docker/followers","following_url":"https://api.github.com/users/docker/following{/other_user}","gists_url":"https://api.github.com/users/docker/gists{/gist_id}","starred_url":"https://api.github.com/users/docker/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/docker/subscriptions","organizations_url":"https://api.github.com/users/docker/orgs","repos_url":"https://api.github.com/users/docker/repos","events_url":"https://api.github.com/users/docker/events{/privacy}","received_events_url":"https://api.github.com/users/docker/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/docker/docker","description":"Docker - the open-source application container engine","fork":false,"url":"https://api.github.com/repos/docker/docker","forks_url":"https://api.github.com/repos/docker/docker/forks","keys_url":"https://api.github.com/repos/docker/docker/keys{/key_id}","collaborators_url":"https://api.github.com/repos/docker/docker/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/docker/docker/teams","hooks_url":"https://api.github.com/repos/docker/docker/hooks","issue_events_url":"https://api.github.com/repos/docker/docker/issues/events{/number}","events_url":"https://api.github.com/repos/docker/docker/events","assignees_url":"https://api.github.com/repos/docker/docker/assignees{/user}","branches_url":"https://api.github.com/repos/docker/docker/branches{/branch}","tags_url":"https://api.github.com/repos/docker/docker/tags","blobs_url":"https://api.github.com/repos/docker/docker/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/docker/docker/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/docker/docker/git/refs{/sha}","trees_url":"https://api.github.com/repos/docker/docker/git/trees{/sha}","statuses_url":"https://api.github.com/repos/docker/docker/statuses/{sha}","languages_url":"https://api.github.com/repos/docker/docker/languages","stargazers_url":"https://api.github.com/repos/docker/docker/stargazers","contributors_url":"https://api.github.com/repos/docker/docker/contributors","subscribers_url":"https://api.github.com/repos/docker/docker/subscribers","subscription_url":"https://api.github.com/repos/docker/docker/subscription","commits_url":"https://api.github.com/repos/docker/docker/commits{/sha}","git_commits_url":"https://api.github.com/repos/docker/docker/git/commits{/sha}","comments_url":"https://api.github.com/repos/docker/docker/comments{/number}","issue_comment_url":"https://api.github.com/repos/docker/docker/issues/comments{/number}","contents_url":"https://api.github.com/repos/docker/docker/contents/{+path}","compare_url":"https://api.github.com/repos/docker/docker/compare/{base}...{head}","merges_url":"https://api.github.com/repos/docker/docker/merges","archive_url":"https://api.github.com/repos/docker/docker/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/docker/docker/downloads","issues_url":"https://api.github.com/repos/docker/docker/issues{/number}","pulls_url":"https://api.github.com/repos/docker/docker/pulls{/number}","milestones_url":"https://api.github.com/repos/docker/docker/milestones{/number}","notifications_url":"https://api.github.com/repos/docker/docker/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/docker/docker/labels{/name}","releases_url":"https://api.github.com/repos/docker/docker/releases{/id}","created_at":"2013-01-18T18:10:57Z","updated_at":"2016-01-03T23:13:02Z","pushed_at":"2016-01-03T23:49:07Z","git_url":"git://github.com/docker/docker.git","ssh_url":"git@github.com:docker/docker.git","clone_url":"https://github.com/docker/docker.git","svn_url":"https://github.com/docker/docker","homepage":"http://www.docker.com","size":121383,"stargazers_count":27462,"watchers_count":27462,"language":"Go","has_issues":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":7540,"mirror_url":null,"open_issues_count":1265,"forks":7540,"open_issues":1265,"watchers":27462,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/docker/docker/pulls/18452"},"html":{"href":"https://github.com/docker/docker/pull/18452"},"issue":{"href":"https://api.github.com/repos/docker/docker/issues/18452"},"comments":{"href":"https://api.github.com/repos/docker/docker/issues/18452/comments"},"review_comments":{"href":"https://api.github.com/repos/docker/docker/pulls/18452/comments"},"review_comment":{"href":"https://api.github.com/repos/docker/docker/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/docker/docker/pulls/18452/commits"},"statuses":{"href":"https://api.github.com/repos/docker/docker/statuses/b7eb12e361e870a4522bc745315547bdc4bfad71"}}}}