Repository navigation
Support nerdctl run --security-opt=XXX #11
Description
Activity
- changed the title
[-]Support `nerdctl run --seccomp=XXX`[/-][+]Support `nerdctl run --security-opt=XXX`[/+]on Dec 7, 2020 @AkihiroSuda mentions that apparmor support has been implemented. Unfortunately, deploying my lxkns discovery service using the existing docker-compose.yaml fails, seemingly the security option from the composer file doesn't get applied?
Admittedly, this might have been composed in infosec theory hell 😁:
version: '2.4' services: lxkns: image: lxkns:latest read_only: true build: context: ../.. dockerfile: deployments/lxkns/Dockerfile command: - "/lxkns" - "--initialcgroup" - "--docker=unix:///proc/1/root/run/docker.sock" - "--containerd=/proc/1/root/run/containerd/containerd.sock" ports: - "5010:5010" user: "65534" security_opt: # apparmor only accepts a profile name, which must have been loaded # by the system admin. You might want to use the lxkns-apparmor # profile to be found in this directory. - apparmor:unconfined #- apparmor:lxkns # Please note that Docker's default container seccomp profile is # adaptive: it allows all those syscalls for which the process has # matching capabilities. In consequence, this Docker default seccomp # profile thus does not interfere with lxkns. However, we still want # to slightly curb the unneeded parts of the powers bestowed upon us # by especially CRAP_SYS_ADMIN and CAP_SYS_PTRACE... - seccomp:deployments/lxkns/lxkns-seccomp.json cap_drop: - ALL cap_add: - SYS_ADMIN # change namespaces - SYS_CHROOT # change mount namespaces - SYS_PTRACE # access nsfs namespace information - DAC_READ_SEARCH # for fully discovering bind-mounted namespaces - DAC_OVERRIDE # for accessing the containerd API socket # We need the full PID view for correct scanning. pid: host
- The composer file specifies to unconfine the deployed service w.r.t. AppArmor.
- My service triggers this audit message, indicating that nerdctl's default AppArmor profile still gets applied:
[40708.544657] audit: type=1400 audit(1627283465.367:1019): apparmor="DENIED" operation="ptrace" profile="nerdctl-default" pid=1147581 comm="lxkns" requested_mask="read" denied_mask="read" peer="unconfined" - The Seccomp profile shouldn't be of any concern, as there are no Seccomp-related audit messages and the service-specific profile actually is more restrictive than the default profile (well, should be unless
nerdctlhas put a skeleton into the Seccomp closet).
Shouldn't
nerdctl composeunconfine my service?(oh, and SELinux support for setting the context (elements) would be great either!)
Reacted by vmojzis and Alessio GreggiHi guys, any news about SELinux support?
Related to runfinch/finch#192, I think it would be great if
nerdctlcould support SELinux, but also ignore anything settings on macOS where it would not be applicable.I'm interested in implementing this @AkihiroSuda, is it free for grabs?
Reacted by Hanchin Hsieh@arnaldo2792 Feel free to have a try.
Ok, I started to work on it 👍
Reacted by Alessio Greggi and kloud-byunReacted by Alessio Greggi, kloud-byun and Simon SkoczylasI'm still going through this, it took me some time to configure a reliable setup and understanding what docker/containerd-cri do when
SecurityOptis set tolabel:<>. I have a better understanding now, I should have something soon-ish to be reviewed, since I'm mostly working on my free time 👍Reacted by Alessio Greggi and Simon Skoczylas- added a sub-issue
on Nov 21, 2025 #4639 support to set selinux.
- linked a pull request that will close this issuefeature: support selinux #4639
on Apr 25, 2026
Add the security options to the
nerdctl run.Seccomp security profiles for Docker
AppArmor security profiles for Docker