kguardian Automates Kubernetes Seccomp Profiles Using eBPF Syscall Tracing

Most Kubernetes operators skip custom seccomp profiles because building accurate allowlists manually is error-prone and a wrong profile can silently kill a container process. kguardian addresses this by using eBPF to trace every syscall a pod actually makes and maintaining a running union of observed syscall names per pod. The tool offers five capture tiers, but only the full tier is safe for enforcement, as partial captures produce profiles that deny whichever syscalls were never traced. Once sufficient data is collected under real load, users export a SeccompProfile custom resource that the controller automatically distributes as a file to each node's kubelet directory. File distribution is disabled by default and must be explicitly enabled, since deploying a profile is treated as a workload-availability decision left to the operator.