[service] [request]: Custom seccomp profile for ECS containers
- Dominant language
- Shell
- Stars
- 5.4k
- Forks
- 334
- PR merge metrics
- No merged PRs in 30d
Description
### Community Note
* Please vote on this issue by adding a 👍 [reaction](https://blog.github.com/2016-03-10-add-reactions-to-pull-requests-issues-and-comments/) to the original issue to help the community and maintainers prioritize this request
* Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
* If you are interested in working on this issue or have submitted a pull request, please leave a comment
**Tell us about your request**
Ability to add custom seccomp profile to ECS containers
**Which service(s) is this request for?**
ECS
**Tell us about the problem you're trying to solve. What are you trying to do, and why is it hard?**
We'd like to securely run headless chromium on ECS. We'd like to run the container giving the least privileges possible and that involves passing in a custom seccomp.json file (https://github.com/docker/for-linux/issues/496#issuecomment-441149510).
ECS `dockerSecurityOptions` doesn't not support custom seccomp files.
**Are you currently working around this issue?**
We are using EKS as a workaround and this is blocking our migration to ECS.
**Additional context**
Anything else we should know?
**Attachments**
If you think you might have additional information that you'd like to include via an attachment, please do - we'll take a look. (Remember to remove any personally-identifiable information.)
Contributor guide
Research direction
Start by reviewing the ECS dockerSecurityOptions limitation and the linked Docker seccomp discussion. The request is complete when ECS containers can receive a custom seccomp.json profile with the least required privileges, enabling the headless Chromium use case without the EKS workaround.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, docker
- Domain
- cloud, infrastructure, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 20/100