<p>Trying to set a custom seccomp profile when using <code>kubectl apply</code> and despite the file being there in the container, the pod will not start with the following error:</p>
<pre><code>Error: failed to create containerd container: cannot load seccomp profile &quot;/var/lib/kubelet/seccomp/custom_profile.json&quot;: open /var/lib/kubelet/seccomp/custom_profile.json: no such file or directory
</code></pre>
<p><strong>K8 deployment YAML</strong></p>
<pre><code>...
containers:
  - name: container-name
    image: container-image:version
    securityContext:
      seccompProfile:
        type: Localhost
        localhostProfile: custom_profile.json
...
</code></pre>
<p>The file is copied when the container is created and going into the shell of the pod I can see that it does exist there (when not trying to load it and the pod starts)</p>
<p><strong>Dockerfile</strong></p>
<pre><code>...
COPY custom_profile.json /var/lib/kubelet/seccomp/custom_profile.json
...
</code></pre>
<p>I have also tried changing the owner (<code>chown</code>) and running with root privileges but as long as the <code>localhostProfile: custom_profile.json</code> line is in the YAML then the same error appears again.</p>
<p>What am I missing that is preventing the file from being found? Something missing in the YAML, something missing in the container/dockerfile?</p>
<p>The following article is what got me this far but still not able to set the profile: <a href="https://docs.openshift.com/container-platform/4.8/security/seccomp-profiles.html" rel="nofollow noreferrer">https://docs.openshift.com/container-platform/4.8/security/seccomp-profiles.html</a></p>

<p>If <code>type: Localhost</code> seccomp profile is used, then the <code>seccomp</code> profiles must be present over the node on which the pod is getting scheduled. Also, the path is relative to the path <code>/var/lib/kubelet/seccomp</code>. Here <code>/var/lib/kubelet/</code> is the default path for <code>kubelet</code> config.</p>
<p>Here is the related snippet from official <a href="https://kubernetes.io/docs/concepts/policy/pod-security-policy/#seccomp" rel="nofollow noreferrer">documentation</a>:</p>
<blockquote>
<p><code>localhost/&lt;path&gt;</code> - Specify a profile as a file on the node located at
&lt;seccomp_root&gt;/, where &lt;seccomp_root&gt; is defined via the
<code>--seccomp-profile-root</code> flag on the Kubelet. If the <code>--seccomp-profile-root</code> flag is not defined, the default path will be used, which is /seccomp where  is specified by the
--root-dir flag.</p>
</blockquote>
<p><strong>Example-1</strong>: For the following to work , a <code>custom_profile.json</code> file must be present at  <code>/var/lib/kubelet/seccomp</code> path on the node.</p>
<pre><code>securityContext:
  seccompProfile:
    type: Localhost
    localhostProfile: custom_profile.json
</code></pre>
<p><strong>Example-2</strong>: For the following to work , a <code>custom_profile.json</code> file must be present at  <code>/var/lib/kubelet/seccomp/profiles</code> path on the node.</p>
<pre><code>securityContext:
  seccompProfile:
    type: Localhost
    localhostProfile: profiles/custom_profile.json
</code></pre>
<p><strong>Here is a minimal working example:</strong></p>
<p><code>seccomp</code> profiles are copied on the worker node.</p>
<pre><code>ps@worker-node:~$ sudo ls -lrt /var/lib/kubelet/seccomp/profiles
[sudo] password for ps:
total 12
-rw-r--r-- 1 root root   39 Sep 10 13:54 audit.json
-rw-r--r-- 1 root root   41 Sep 10 13:54 violation.json
-rw-r--r-- 1 root root 1657 Sep 10 13:54 fine-grained.json
ps@worker-node:~$
</code></pre>
<p>Create the pod with the following path, notice the path is relative to <code>/var/lib/kubelet/seccomp</code>.</p>
<pre><code>apiVersion: v1
kind: Pod
metadata:
  name: audit-pod
  labels:
    app: audit-pod
spec:
  securityContext:
    seccompProfile:
      type: Localhost
      localhostProfile: profiles/audit.json
  containers:
  - name: test-container
    image: nginx
    securityContext:
      allowPrivilegeEscalation: false
</code></pre>
