Metadata

Id: dockercompose-apparmor-profile-unconfined

Platform: DockerCompose

Severity: Medium

Category: Resource Management

Learn More

• Provider Reference

Description

Setting apparmor:unconfined in security_opt explicitly disables the AppArmor policy Docker would otherwise apply, removing mandatory access controls that restrict container access to host resources. Services should omit this override to use Docker’s docker-default profile or specify a loaded custom AppArmor profile.

Compliant Code Examples

services:
  implicit_default:
    image: alpine
  explicit_default:
    image: alpine
    security_opt:
      - apparmor:docker-default
  custom_profile:
    image: alpine
    security_opt:
      - apparmor=my-custom-profile

Non-Compliant Code Examples

services:
  colon_syntax:
    image: alpine
    security_opt:
      - apparmor:unconfined
  equals_syntax:
    image: alpine
    security_opt:
      - apparmor=unconfined