Docker and CI/CD · Senior · Question 6 of 75
What does Docker's default seccomp profile do?
- 1Scans images for known vulnerabilities before they start
- 2Encrypts all of the traffic between containers on a host
- ✓Correct answer: Blocks dozens of risky system calls for container processes
Explanation
Calls like reboot, kernel module loading or some mount variants are denied, reducing kernel attack surface. --privileged or seccomp=unconfined turn this off.