Troubleshooting Docker Seccomp & AppArmor Profiles (3000)

Technical Overview

Engineering breakdown of Troubleshooting Docker Seccomp & AppArmor Profiles (3000). Bare-metal hardware performance requires isolated kernel parameters, syscall filtering, and mandatory access control (MAC) policies that align with container runtime expectations. This guide dissects the interaction between Docker's default seccomp profile, custom AppArmor profiles, and the Linux kernel's security modules, providing a systematic methodology for diagnosing permission denials, syscall violations, and profile mismatches on bare-metal clusters.

Architecture & Threat Model

On bare-metal, the attack surface expands because containers share the host kernel directly. Seccomp (secure computing mode) filters syscalls per-container, while AppArmor confines filesystem, network, and capability access via path-based profiles. Docker ships a default seccomp profile (/var/lib/docker/seccomp/default.json) that blocks ~44 syscalls (e.g., keyctl, bpf, userfaultfd). AppArmor profiles are loaded via apparmor_parser and attached to containers through the security_opt flag. Misalignment between these layers manifests as EPERM errors, audit log entries (type=SECCOMP or type=APPARMOR), and silent failures in privileged workloads.

Diagnostic Workflow

1. Enable Auditing: auditctl -a always,exit -F arch=b64 -S all -k docker_seccomp and auditctl -a always,exit -F arch=b64 -S all -k docker_apparmor.
2. Reproduce: Run the failing container with --security-opt seccomp=unconfined and --security-opt apparmor=unconfined to isolate the layer.
3. Analyze Logs: ausearch -k docker_seccomp --raw | aureport --syscall reveals blocked syscalls; dmesg -T | grep apparmor shows profile denials.
4. Profile Iteration: Generate a custom seccomp profile with docker run --rm -it --security-opt seccomp=unconfined alpine sh -c 'apk add strace && strace -f -e trace=all your-app 2>&1 | grep -E "^\w+\(.*\) = -1 EPERM"' > blocked_syscalls.txt. Convert to JSON via python3 -c "import json,sys; print(json.dumps({'defaultAction':'SCMP_ACT_ALLOW','syscalls':[{'names':[l.strip() for l in open('blocked_syscalls.txt')],'action':'SCMP_ACT_ERRNO'}]}, indent=2))" > custom-seccomp.json.
5. AppArmor Tuning: Use aa-genprof or aa-logprof to iteratively build a profile from audit logs.

Benchmark: Profile Overhead on Bare Metal

We measured syscall latency (nanoseconds) on an Intel Xeon Gold 6248R (3.0 GHz) with Linux 6.8, Docker 26.1, using perf stat -e syscalls:sys_enter_* -a -- sleep 10 across 1000 container starts.

Key takeaway: Seccomp overhead scales with number of filtered syscalls; AppArmor adds path-resolution cost. On bare-metal, the absolute overhead remains sub-microsecond per syscall, but high-frequency workloads (e.g., gRPC, DPDK) should profile with perf record -g -- docker run ... to identify hot paths.

Common Failure Patterns & Fixes

• EPERM on bpf(): Default seccomp blocks bpf. Workloads using eBPF (Cilium, bpftrace) need "action": "SCMP_ACT_ALLOW" for bpf in custom profile.
• AppArmor denied on /proc/*/ns/*: Container runtime requires namespace introspection. Add /proc/*/ns/* r, to profile.
• Seccomp SIGSYS on clone3: Newer glibc uses clone3; older seccomp profiles lack it. Update profile to allow clone3 or set defaultAction: SCMP_ACT_LOG for debugging.
• Silent Failure with CAP_SYS_ADMIN: Even with capabilities, seccomp may block mount, pivot_root. Use --privileged only for debugging; craft minimal profile instead.

Production Hardening Checklist

1. Store profiles in version control (GitOps) with CI validation: apparmor_parser -Q -p profiles/app-myapp and jq empty custom-seccomp.json.
2. Deploy via Kubernetes SecurityContext or Docker Compose security_opt with immutable tags.
3. Enable auditd rules on all nodes; forward to centralized SIEM (Elastic, Splunk).
4. Run docker bench security weekly; enforce no-new-privileges.
5. Automate profile generation in staging: aa-genprof --dry-run against integration test suite.