Load AppArmor profile inside Docker container

Question

I would like to load another AppArmor profile inside a Docker container. The docker container itself uses the docker-default profile. The other profile is supposed to enforce the docker-default restrictions and more - largely restricting any file system access inside the container. As it is apparently not possible to change the profile inside the container, I post this question to inquire what other options there are.

1. One option that I am considering is to write a local profile that docker-default is permitted to transition to. Though, I suppose that this would have to be written into the docker-default AppArmor profile, which is not located in /etc/apparmor.d. The docker-default profile is apparently based on this template.

   How would I go about it? Do I just paste the local profile into the template, followed by executing apparmor_parser -r -W template.go? How do I overwrite default-docker? By naming template.go docker-default.go?

   I guess that overwriting docker-default is not the best option as those modifications might be overwritten when Docker is updated.

2. Another option appears to be running the container with --privileged. As that makes the container generally less secure, I would like to avoid this.

Some background on the setup I am working on: I am writing a number of R shiny apps which are deployed through ShinyProxy on an Ubuntu 20.04 machine. ShinyProxy spins up individual app sessions as separate Docker containers with the docker-default AppArmor profile. In some of the apps' functionalities, users enter R code through a shinyAce console which is evaluated in the backend. Letting users execute code in the backend is usually not a good idea, but mandatory in this case. As I largely want to restrict the users' access to the file system and data stored inside and outside the Docker container, I intend to use the RAppArmor and unix packages. unix::eval_safe allows executing functions while enforcing one of the machine's AppArmor profiles. Because the docker-default profile is activated throughout the app session, unix::eval_safe, and internally RAppArmor::aa_change_profile, fail to load another profile.

What would be a secure and robust solution to this problem?