Using Container Security Profiles

Security profiles allow you to leverage existing security tools in Linux and implement them across your Docker images. In the following sections, we will cover both AppArmor and seccomp. These are the ways by which you can reduce the amount of access that processes can gain when running on your Docker environments. They are both simple to use and you'll find you will most likely be using them already in your images. We will look at both of them separately but note that AppArmor and Security Computing for Linux do overlap with their functionality. For the time being, all you need to remember is that AppArmor stops applications from accessing files that they shouldn't be accessing, while Security Computing for Linux will help stop any Linux kernel vulnerabilities from being exploited.

By default, and especially if you have an up-to-date version of Docker running, you may already have both running. You can verify this by running the docker...