---
title: AppArmor profile set to unconfined
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > Code Security > Infrastructure as Code (IaC)
  Security > IaC Security Rules > AppArmor profile set to unconfined
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# AppArmor profile set to unconfined

{% callout %}
# Important note for users on the following Datadog sites: app.ddog-gov.com, us2.ddog-gov.com

{% alert level="danger" %}
This product is not supported for your selected [Datadog site](https://docs.datadoghq.com/getting_started/site.md). ({% placeholder "user-datadog-site-name" /%}).
{% /alert %}

{% /callout %}

## Metadata{% #metadata %}

**Id:** `kubernetes-missing-app-armor-config` 

**Platform:** Kubernetes

**Severity:** Low

**Category:** Access Control

#### Learn More{% #learn-more %}

- [Provider Reference](https://kubernetes.io/docs/tutorials/clusters/apparmor/)

### Description{% #description %}

AppArmor restricts the low-level system resources a container can access. On nodes with AppArmor enabled, containers run with the container runtime's default profile unless they opt out, so leaving the profile unset is safe. This rule flags containers that explicitly disable AppArmor, either through the `container.apparmor.security.beta.kubernetes.io/<container>: unconfined` annotation or through `securityContext.appArmorProfile.type: Unconfined` at the Pod or container level, which the Pod Security Standards baseline profile forbids. Use `RuntimeDefault` or a `Localhost` profile instead.

## Compliant Code Examples{% #compliant-code-examples %}

```yaml
apiVersion: v1
kind: Pod
metadata:
  name: hello-apparmor-localhost
  annotations:
    container.apparmor.security.beta.kubernetes.io/hello: localhost/k8s-apparmor-example-allow-write
spec:
  containers:
  - name: hello
    image: busybox
    command: [ "sh", "-c", "echo 'Hello AppArmor!' && sleep 1h" ]
---
apiVersion: v1
kind: Pod
metadata:
  name: hello-apparmor-default
spec:
  containers:
  - name: hello
    image: busybox
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: hello-apparmor-runtime-default
spec:
  selector:
    matchLabels:
      app: hello
  template:
    metadata:
      labels:
        app: hello
    spec:
      securityContext:
        appArmorProfile:
          type: RuntimeDefault
      containers:
      - name: hello
        image: busybox
        securityContext:
          appArmorProfile:
            type: Localhost
            localhostProfile: k8s-apparmor-example-deny-write
```

## Non-Compliant Code Examples{% #non-compliant-code-examples %}

```yaml
apiVersion: v1
kind: Pod
metadata:
  name: hello-apparmor-1
  annotations:
    container.apparmor.security.beta.kubernetes.io/hello1: unconfined
spec:
  containers:
  - name: hello1
    image: busybox
    command: [ "sh", "-c", "echo 'Hello AppArmor!' && sleep 1h" ]
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: ubuntu-test1
  namespace: testns
spec:
  replicas: 1
  selector:
    matchLabels:
      container: ubuntu-1
  template:
    metadata:
      labels:
        container: ubuntu-1
    spec:
      securityContext:
        appArmorProfile:
          type: Unconfined
      containers:
      - name: ubuntu-1-container
        image: 0x010/ubuntu-w-utils:1.0
---
apiVersion: v1
kind: Pod
metadata:
  name: hello-apparmor-3
spec:
  containers:
  - name: hello3
    image: busybox
    securityContext:
      appArmorProfile:
        type: Unconfined
```

```yaml
apiVersion: batch/v1
kind: CronJob
metadata:
  name: nightly-backup
spec:
  schedule: "0 2 * * *"
  jobTemplate:
    spec:
      template:
        metadata:
          annotations:
            container.apparmor.security.beta.kubernetes.io/backup: unconfined
        spec:
          restartPolicy: OnFailure
          containers:
            - name: backup
              image: busybox:1.36
```