In face of the reminders that the Docker Engine should be run contained with AppArmor or SELinux, how to run Docker under AppArmor on Ubuntu 14.04?

The Docker Security documentation and the LXC documentation mention that Ubuntu comes with AppArmor templates for LXC. What has to be done to take advantage of that?

Assuming a default Ubuntu Server 14.04 host, and Docker installed with curl -s https://get.docker.io/ubuntu/ | sudo sh, what has to be done next so that when running a container, the Docker Engine itself will be contained under AppArmor?


Well, this is a problem with using packages from outside the Ubuntu repositories. You will need to either ask the Docker Engine Developers to write an apparmor profile for you or write your own. Same with a selinux profile.

Now here is where you will start to get options, should you use or not use LXC, apparmor, selinux, etc.

For example, the Docker developers feel you need to update - http://blog.docker.com/ and that is certainly one way to manage the situation.

Apparmor and selinux protect you (potentially) from zero day exploits, but exploits are fixed via updates.

The advantage of apparmor is that it is easier to learn. The disadvantage is that you have to write you own profile.

See the apparmor documentation



or, for a practical example, using a rather simple program, see http://blog.bodhizazen.com/linux/apparmor-privoxy-profile/

As long as we are on opinions ...

RHEL and Fedora are a bit ahead of the curve compared to Ubuntu in terms of Virtualization. RHEL is working with Docker to provide support, including selinux


I am not sure about Fedora and Docker, but Fedora uses selinux and virtmanager to manage LXC - http://major.io/2014/04/21/launch-secure-lxc-containers-on-fedora-20-using-selinux-and-svirt/

At the end of the day, you will have to review the opinions and go with the solution that works best for you.

  • Thanks for the informative answer. I gather that Ubuntu's default LXC AppArmor profile doesn't apply to Docker's latest version (1.0) and that one must create a custom profile. I believe that other people will look for a standard profile for Docker 1.0 on Ubuntu 14.04, so I'll leave the question open in the hope that in the future someone will develop and share one. Also, thanks for the suggestion of RedHat and SELinux as alternatives. Jun 19 '14 at 17:57
  • It should not be too difficult to use the default LXC apparmor profile as a template and debug.
    – Panther
    Jun 19 '14 at 18:04

Current version of docker-engine is 1.10.2-cs1, and here is the default AppArmor Profile for running containers that Docker provides at https://docs.docker.com/engine/security/apparmor/

#include <tunables/global>

profile docker-default flags=(attach_disconnected,mediate_deleted) {

  #include <abstractions/base>


  deny @{PROC}/{*,**^[0-9*],sys/kernel/shm*} wkx,
  deny @{PROC}/sysrq-trigger rwklx,
  deny @{PROC}/mem rwklx,
  deny @{PROC}/kmem rwklx,
  deny @{PROC}/kcore rwklx,

  deny mount,

  deny /sys/[^f]*/** wklx,
  deny /sys/f[^s]*/** wklx,
  deny /sys/fs/[^c]*/** wklx,
  deny /sys/fs/c[^g]*/** wklx,
  deny /sys/fs/cg[^r]*/** wklx,
  deny /sys/firmware/efi/efivars/** rwklx,
  deny /sys/kernel/security/** rwklx,

To load a new profile into AppArmor: $ apparmor_parser -r -W /path/to/your_profile

When you run a container, it uses the docker-default policy unless you override it with the security-opt option. For example, the following explicitly specifies the a different docker policy:

$ docker run --rm -it --security-opt apparmor:docker-different hello-world

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.