Can I confine an executable inside a Docker container using a host apparmor profile?

I'm trying to containerize an application that currently uses apparmor to confine Python. This allows sandboxing of user-submitted code. How can I get docker and apparmor to play well together?

Current non-containerized setup:

• Create a sandbox system user
• Create a Python virtualenv with its own copy of the python binary
• Create and load an apparmor profile that only allows that python to access a couple of directories
• Run the user code as sandbox, using the confined python

It's easy to use --security-opt apparmor=... to confine an entire Docker container, but that doesn't keep user code separate from trusted application code within the container. I can even target paths within the container's filesystem, but all of the executables in the container have the same confinement or lack thereof.

Is there a way to create an apparmor profile that says "/app/sandbox/python is only allowed to access /app/sandbox/data", with both of those paths relative to the container's filesystem?

posted 11 months ago

CC BY-SA 4.0

much‭

6 reputation 2 0 1 1