Scaling Docker Seccomp & AppArmor Profiles (6895)

Technical Overview

Engineering breakdown of Scaling Docker Seccomp & AppArmor Profiles (6895). Bare-metal hardware performance requires isolated kernel parameters, syscall filtering, and mandatory access control (MAC) policies that evolve with workload density. This article dissects the interplay between seccomp-bpf filters and AppArmor profiles at scale, leveraging eBPF for dynamic policy enforcement, observability, and zero-downtime updates.

Key Challenges

• Profile explosion: thousands of microservices each demanding tailored syscall allowlists.
• Kernel version drift: seccomp BPF ABI changes across LTS kernels.
• Audit fatigue: noisy logs from denied syscalls obscure real anomalies.
• Update latency: rolling out profile changes without container restarts.

Architecture

We introduce a control-plane built on Cilium's eBPF datapath that compiles high-level policy (JSON/YAML) into per-cgroup seccomp filters and AppArmor profiles, then atomically swaps them via bpf_prog_attach and apparmor_parser -r. A sidecar collector streams syscall telemetry to a ClickHouse cluster for real-time heatmaps.