System Hardening
System hardening reduces both host and container attack surface. On the node, that means minimal installed packages, disabled unused services, SSH key-only access, and kernel hardening. In Kubernetes, it means applying Linux security primitives to workloads: AppArmor, SELinux, seccomp, and capability dropping.
Know how each primitive is expressed. Seccomp is configured in the pod or container securityContext with seccompProfile.type set to RuntimeDefault, Localhost with a profile path, or Unconfined. AppArmor on current clusters uses the securityContext.appArmorProfile field; older manifests use the annotation container.apparmor.security.beta.kubernetes.io/<container>. SELinux uses seLinuxOptions with user, role, type, and level.
Understand that these profiles must exist on the host: a Localhost seccomp profile is a path relative to the kubelet's seccomp root, and an AppArmor profile must already be loaded into the kernel. Traps: assuming RuntimeDefault blocks every syscall (it blocks a curated set), mixing seccomp annotation names across Kubernetes versions, and adding capabilities without dropping ALL first.
Worked example: to run a container unprivileged, set runAsNonRoot: true, runAsUser: 1000, allowPrivilegeEscalation: false, capabilities.drop: [ALL], readOnlyRootFilesystem: true, and seccompProfile.type: RuntimeDefault.