I would like to load another AppArmor profile inside a Docker container. The docker container itself uses the docker-default profile. The other profile is supposed to enforce the docker-default restrictions and more - largely restricting any file system access inside the container. As it is apparently not possible to change the profile inside the container, I post this question to inquire what other options there are.

  1. One option that I am considering is to write a local profile that docker-default is permitted to transition to. Though, I suppose that this would have to be written into the docker-default AppArmor profile, which is not located in /etc/apparmor.d. The docker-default profile is apparently based on this template.

    How would I go about it? Do I just paste the local profile into the template, followed by executing apparmor_parser -r -W template.go? How do I overwrite default-docker? By naming template.go docker-default.go?

    I guess that overwriting docker-default is not the best option as those modifications might be overwritten when Docker is updated.

  2. Another option appears to be running the container with --privileged. As that makes the container generally less secure, I would like to avoid this.

Some background on the setup I am working on: I am writing a number of R shiny apps which are deployed through ShinyProxy on an Ubuntu 20.04 machine. ShinyProxy spins up individual app sessions as separate Docker containers with the docker-default AppArmor profile. In some of the apps' functionalities, users enter R code through a shinyAce console which is evaluated in the backend. Letting users execute code in the backend is usually not a good idea, but mandatory in this case. As I largely want to restrict the users' access to the file system and data stored inside and outside the Docker container, I intend to use the RAppArmor and unix packages. unix::eval_safe allows executing functions while enforcing one of the machine's AppArmor profiles. Because the docker-default profile is activated throughout the app session, unix::eval_safe, and internally RAppArmor::aa_change_profile, fail to load another profile.

What would be a secure and robust solution to this problem?


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.