I would like to load another AppArmor profile inside a Docker container. The docker container itself uses the
docker-default profile. The other profile is supposed to enforce the
docker-default restrictions and more - largely restricting any file system access inside the container. As it is apparently not possible to change the profile inside the container, I post this question to inquire what other options there are.
One option that I am considering is to write a local profile that
docker-defaultis permitted to transition to. Though, I suppose that this would have to be written into the
docker-defaultAppArmor profile, which is not located in
docker-defaultprofile is apparently based on this template.
How would I go about it? Do I just paste the local profile into the template, followed by executing
apparmor_parser -r -W template.go? How do I overwrite
default-docker? By naming
I guess that overwriting
docker-defaultis not the best option as those modifications might be overwritten when Docker is updated.
Another option appears to be running the container with
--privileged. As that makes the container generally less secure, I would like to avoid this.
Some background on the setup I am working on: I am writing a number of R shiny apps which are deployed through ShinyProxy on an Ubuntu 20.04 machine. ShinyProxy spins up individual app sessions as separate Docker containers with the
docker-default AppArmor profile. In some of the apps' functionalities, users enter R code through a shinyAce console which is evaluated in the backend. Letting users execute code in the backend is usually not a good idea, but mandatory in this case. As I largely want to restrict the users' access to the file system and data stored inside and outside the Docker container, I intend to use the
unix::eval_safe allows executing functions while enforcing one of the machine's AppArmor profiles. Because the
docker-default profile is activated throughout the app session,
unix::eval_safe, and internally
RAppArmor::aa_change_profile, fail to load another profile.
What would be a secure and robust solution to this problem?