title: Get apparmor working on docker container
body: <p>I am playing with apparmor and docker on Ubuntu 16.04 and I can get it to run on a container... sometimes</p>
  
  <p>Docker version 18.03.0-ce, build 0520e24</p>
  
  <p><code>$ docker run -it ubuntu bash</code></p>
  
  <p>Results in a docker container running ubuntu 16.04 as expected</p>
  
  <p><code>$ sudo aa-status</code></p>
  
  <p>shows that docker-default is active on a container</p>
  
  <p>and running <code>$ cat /proc/sysrq-trigger</code> inside the container via bash returns the predicted "permission denied" because it is blocked by default-docker apparmor profile as per the following guide: <a href="https://cloud.google.com/container-optimized-os/docs/how-to/secure-apparmor#creating_a_custom_security_profile" rel="nofollow noreferrer">https://cloud.google.com/container-optimized-os/docs/how-to/secure-apparmor#creating_a_custom_security_profile</a></p>
  
  <p>Following that up with a </p>
  
  <p><code>$ docker run -it --security-opt apparmor=unconfined ubuntu bash</code></p>
  
  <p>returns expected results for <code>$ sudo aa-status</code> and <code>$ cat /proc/sysrq-trigger</code> returns
  <code>cat: /proc/sysrq-trigger: Input/output error</code></p>
  
  <p>Everything is fine up to this point, but now if I run the container in detached mode, the apparmor profile stops working (ref: <a href="https://docs.docker.com/engine/security/apparmor/#resources-for-writing-profiles" rel="nofollow noreferrer">https://docs.docker.com/engine/security/apparmor/#resources-for-writing-profiles</a>)</p>
  
  <p>I am able to build the apparmor profile and see it running with aa-status but when I exec into the container, nothing is blocked. It doesnt work for the nginx container, and I have tried with other containers. But it wont block anything if I run in a detached state <code>$ docker run -d ubuntu tail -f /dev/null</code> regardless how I apply --security-opt.</p>
  
  <p>Can anyone explain how apparmor works with docker and why this is the case?</p>
  
  <p>Thank you!</p>