---
title: Containers should have an enabled AppArmor profile
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > OOTB Rules > Containers should have an enabled
  AppArmor profile
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# Containers should have an enabled AppArmor profile
Classification:complianceFramework:cis-dockerControl:5.2 
## Description{% #description %}

On a host with AppArmor, containers should run under an AppArmor profile.

## Rationale{% #rationale %}

An AppArmor profile restricts the files, capabilities, and mounts of the processes of a container, which limits what an attacker can do from inside it.

## Audit{% #audit %}

Inspect the containers:

```bash
docker ps --quiet --all | xargs docker inspect --format '{{ .Name }}: AppArmorProfile={{ .AppArmorProfile }}'
```

Datadog applies the rule to the hosts whose Docker daemon lists AppArmor among its security options, and to the containers that have started: Docker records the profile of a container when it starts it. It passes the rule when a container runs under a profile, such as `docker-default`, and fails it when the profile is empty or `unconfined`.

## Remediation{% #remediation %}

Run the containers without `--privileged` or `--security-opt apparmor=unconfined`, under `docker-default` or a profile of your own loaded with `apparmor_parser`.

## Impact{% #impact %}

A profile can deny an action that the workload needs, which a profile of its own then allows.

## Default value{% #default-value %}

Docker runs containers under the `docker-default` profile on hosts with AppArmor.

## References{% #references %}

1. [https://docs.docker.com/engine/security/apparmor/](https://docs.docker.com/engine/security/apparmor/)
1. [https://docs.docker.com/engine/containers/run/#security-configuration](https://docs.docker.com/engine/containers/run/#security-configuration)
1. [https://docs.docker.com/engine/security/#other-kernel-security-features](https://docs.docker.com/engine/security/#other-kernel-security-features)