feat: add docs for seccompProfile workspace template fields (#1130)

dwahler · web-flow · commit bad989530634 · 2022-09-28T14:44:28.000-05:00
diff --git a/workspaces/workspace-templates/templates.md b/workspaces/workspace-templates/templates.md
@@ -64,6 +64,10 @@ workspace:
         value:
           - key: annotation-key
             value: annotation-value
+      seccomp-profile-type:
+        value: Localhost
+      seccomp-profile-localhost-profile:
+        value: profiles/custom-profile.json
   configure:
     start:
       value:
@@ -262,6 +266,47 @@ node-selector:
 
 `node-selector` is disabled by default and must be enabled by a site admin.
 
+#### workspace.specs.kubernetes.seccomp-profile-type.value
+
+Applies a [seccomp profile](https://kubernetes.io/docs/tutorials/security/seccomp/)
+to the workspace pod. The value is a string, corresponding to the `type`
+subfield of the PodSecurityContext `seccompProfile` attribute.
+
+For example, the following snippet would explicitly disable seccomp protection:
+
+```yaml
+seccomp-profile-type:
+  value: Unconfined
+```
+
+`seccomp-profile-type` is disabled by default and must be enabled by a site
+admin.
+
+#### workspace.specs.kubernetes.seccomp-profile-localhost-profile.value
+
+Applies a custom [seccomp profile](https://kubernetes.io/docs/tutorials/security/seccomp/)
+to the workspace pod. The value is a string, corresponding to the
+`localhostProfile` subfield of the PodSecurityContext `seccompProfile`
+attribute.
+
+Per the [Kubernetes
+documentation](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.25/#seccompprofile-v1-core),
+this attribute is only valid if used in combination with the `Localhost` seccomp
+profile type. Its value must correspond to the path of a valid JSON profile that
+is already configured on the Kubernetes worker nodes.
+
+The following snippet demonstrates setting a custom profile:
+
+```yaml
+seccomp-profile-type:
+  value: Localhost
+seccomp-profile-localhost-profile:
+  value: profiles/my-custom-profile.json
+```
+
+`seccomp-profile-localhost-profile` is disabled by default and must be enabled
+by a site admin.
+
 #### workspace.configure
 
 This section lists the commands that run within the workspace after Coder builds
