Skip to content

docs: say contrib/apparmor is the CLI profile #25848

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
locker95 wants to merge 2 commits into
base: main
Choose a base branch
from
Open

docs: say contrib/apparmor is the CLI profile #25848

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
8ca469c
docs: say contrib/apparmor is the CLI profile
locker95 Aug 16, 2026
f08f9e8
docs: call /usr/bin/docker the CLI in the AppArmor debug notes
locker95 Aug 16, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 7 additions & 7 deletions content/manuals/engine/security/apparmor.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,11 +17,11 @@ loads it into the kernel.
>
> This profile is used on containers, not on the Docker daemon.

A profile for the Docker Engine daemon exists but it is not currently installed
with the `deb` packages. If you are interested in the source for the daemon
profile, it is located in
No AppArmor profile for `dockerd` is shipped with the `deb` packages. The
files under
[contrib/apparmor](https://github.com/moby/moby/tree/master/contrib/apparmor)
in the Docker Engine source repository.
in the Moby repository are a profile for the `/usr/bin/docker` CLI, not for
the daemon.

## Understand the policies

Expand Down Expand Up @@ -215,7 +215,7 @@ looks like the following:
```

In the above example, you can see `profile=/usr/bin/docker`. This means the
user has the `docker-engine` (Docker Engine daemon) profile loaded.
user has the Docker CLI profile loaded.

Look at another log line:

Expand Down Expand Up @@ -267,15 +267,15 @@ container PIDs is in `enforce` mode. This means AppArmor is actively blocking
and auditing in `dmesg` anything outside the bounds of the `docker-default`
profile.

The output above also shows the `/usr/bin/docker` (Docker Engine daemon) profile
The output above also shows the `/usr/bin/docker` (Docker CLI) profile
is running in `complain` mode. This means AppArmor only logs to `dmesg`
activity outside the bounds of the profile. (Except in the case of Ubuntu
Trusty, where some interesting behaviors are enforced.)

## Contribute to Docker's AppArmor code

Advanced users and package managers can find a profile for `/usr/bin/docker`
(Docker Engine daemon) underneath
(the Docker CLI) underneath
[contrib/apparmor](https://github.com/moby/moby/tree/master/contrib/apparmor)
in the Docker Engine source repository.

Expand Down