# How to use the new Docker Seccomp profiles

DevFeed: [How to use the new Docker Seccomp profiles](<https://devfeed.tech/articles/how-to-use-the-new-docker-seccomp-profiles-35173.md>)

Original publisher: [Read original article](<https://blog.jessfraz.com/post/how-to-use-new-docker-seccomp-profiles/>)

Published: 2016-01-04T23:21:07Z

Content type: tutorial

Language: en

Sources: [Jessie Frazelle](<https://devfeed.tech/sources/jessie-frazelle.md>)

Topics: [Docker](<https://devfeed.tech/topics/docker.md>), [Chrome](<https://devfeed.tech/topics/chrome.md>), [Processes](<https://devfeed.tech/topics/processes.md>), [Scripting, bash](<https://devfeed.tech/topics/scripting-bash.md>)

Tags: [bash](<https://devfeed.tech/tags/bash.md>), [chrome](<https://devfeed.tech/tags/chrome.md>), [docker](<https://devfeed.tech/tags/docker.md>), [how-to](<https://devfeed.tech/tags/how-to.md>), [process](<https://devfeed.tech/tags/process.md>), [security](<https://devfeed.tech/tags/security.md>)

## AI overview

A step-by-step tutorial on creating custom Docker seccomp profiles for containers and debugging missing system calls. It demonstrates tracing a Chrome container with strace, generating a syscall whitelist with a Bash script, and adjusting the profile when Chrome fails because required calls are absent.

## Source excerpt

In case you missed it, we recently merged a default seccomp profile for Docker containers. I urge you to try out the default seccomp profile, mostly so we can rest easy knowing the defaults are sane and your containers work as before. You can download the master version of Docker Engine from master.dockerproject.org or experimental.docker.com. We even have a doc describing the syscalls we purposely block and security vulnerabilities the profile blocked. But that's not what this blog post is about. This post is about how you can create your own custom seccomp profiles for your containers. And how to debug when your profile is missing a syscall. So this is not the most sane thing in the world, I even tried in the process to create a bash script that takes the output from strace, collects the syscalls, and generates a profile. But like all tools of this sort (eg. aa-genprof) it missed some, well to be exact it missed 6. Which is no small feat to debug, so this post is in the format: learn by example. I am going to take you step by step through what I did. Wake up go to starbucks... just kidding... not that specific. I wanted to make a custom profile for my chrome container. I decided to get the syscalls it used by changing the entrypoint for my chrome/Dockerfile to ENTRYPOINT [ "strace", "-ff", "google-chrome" ]. So the only things that changed was wrapping the command in strace and of course installing strace in the container. The -ff option makes sure strace follows forks. Which is essential for chrome because they fork a bunch of processes (fun fact: each tab is a process with it's own PID namespace). Cool beans, moving on. So I used chrome the entire day like this to create the most verbose strace output so I wouldn't miss any syscalls. At the end of the day I saved this output into a file by running docker logs chrome > $HOME/chrome-strace.log 2>&1. Then I used the world's most janky bash script to generate a profile: #!/bin/bash set -e set -o pipefail main(){ local f