Hardening Docker Seccomp & AppArmor Profiles (6088)

Technical Overview

Engineering breakdown of Hardening Docker Seccomp & AppArmor Profiles (6088). Bare-metal hardware performance requires isolated kernel parameters, syscall filtering, and mandatory access control policies that map directly to container runtime behavior.

Seccomp Profile Design

Seccomp (Secure Computing Mode) restricts the system calls a process may invoke. A default Docker profile blocks ~44 syscalls; production workloads often need a tailored allow‑list. The profile is expressed as JSON with defaultAction set to SCMP_ACT_ERRNO and a syscalls array specifying allowed calls per architecture.

AppArmor Profile Integration

AppArmor confines filesystem, network, and capability access. Docker loads a generic docker-default profile, but hardening demands per‑service profiles that deny mount, ptrace, and raw socket creation. Profiles are written in the AppArmor DSL and loaded via apparmor_parser.

Combined Enforcement

Running a container with both --security-opt seccomp=profile.json and --security-opt apparmor=profile-name yields defense‑in‑depth: syscall filtering at the kernel entry point and path‑based MAC at the LSM layer.