AppArmor and SELinux for Container Security

Tanishka Marrott's photo
Tanishka Marrott
·

3 min read

AppArmor and SELinux for Container Security

Containers offer flexibility and efficiency, but they also need robust security. That’s where AppArmor and SELinux come in, adding essential layers of control. Let’s dive into these two security modules and see how they help protect containers. Plus, we’ll look at practical, real-world code snippets that you can directly use to enhance security.

Why AppArmor and SELinux Matter for Container Security

When running containers, your biggest challenge is isolating them from the host and other containers. AppArmor and SELinux enable that by enforcing mandatory access controls (MAC). Think of them as shields that define what a container can access, preventing potential attacks from spreading.

AppArmor: Profile-Based, Simple Control

AppArmor is the easier of the two, but don’t underestimate it. By defining profiles, you tell the system what files and permissions each container has, creating a restricted environment for each one.

Example: Custom AppArmor Profile

Let’s say you want to prevent a container from accessing network resources:

profile container_profile /usr/bin/container {
    # Deny all network access
    deny network,
    # Allow read-only access to /etc
    audit read, /etc/** rw,
}

You can attach this profile to a container like so:

docker run --security-opt apparmor=container_profile myapp

This profile restricts what the container can do, limiting potential exposure. You can block certain system calls and isolate processes from the host—perfect for boosting security without adding complexity.

SELinux: Fine-Grained, High-Control

While AppArmor is profile-based, SELinux works by assigning security labels to everything—files, processes, devices, you name it. It offers more granular control but requires a steeper learning curve.

SELinux Example: Setting Labels for Containers

You can set SELinux labels on your Docker containers for additional restrictions:

docker run --security-opt label:type:svirt_lxc_net_t myapp

Here’s what it does:

  • label:type=svirt_lxc_net_t: Assigns a security type to the container, which restricts access to network resources, just like AppArmor but with a deeper level of control.

Example: Custom SELinux Policy

Here’s a real-life scenario: you want to ensure that no containers can write to /sensitive_dir:

module container_policy 1.0;

require {
    type container_t;
}

# Deny write access to /sensitive_dir for all containers
allow container_t sensitive_dir_t:dir { read open };

Once you write this policy, you load it into SELinux:

semodule -i container_policy.pp

This way, even if a container breaks out, it can’t tamper with sensitive areas on the host.

Combining AppArmor and SELinux with Docker & Kubernetes

Now, let’s look at how these security modules integrate with Docker and Kubernetes. You can enforce them in Kubernetes Pod Security Policies or by attaching profiles during deployment.

Kubernetes Example: Enforcing AppArmor via Annotations

apiVersion: v1
kind: Pod
metadata:
  name: secure-pod
  annotations:
    container.apparmor.security.beta.kubernetes.io/nginx: runtime/default
spec:
  containers:
  - name: nginx
    image: nginx
    securityContext:
      runAsUser: 1000
      readOnlyRootFilesystem: true

This example adds AppArmor profiles to the containers in the pod, ensuring they adhere to strict security rules.

Security Practices: Avoid Hardcoding Secrets

One of the biggest threats in container security is hardcoded secrets. Use AWS Secrets Manager or HashiCorp Vault to securely retrieve sensitive data, ensuring that secrets aren’t baked into your images.

Example:

docker run -e DB_PASSWORD=$(aws secretsmanager get-secret-value --secret-id mydbpassword --query SecretString --output text) myapp

This way, you keep secrets out of the Dockerfile and runtime environment, improving overall security.

Final Thoughts on AppArmor and SELinux

By combining AppArmor's simplicity with SELinux's fine-grained controls, you get a powerful toolkit for container security. Whether you’re isolating resources or enforcing strict access rules, these tools add a critical layer of defense to your containers.

Let’s wrap this up with one key insight: layers matter. The more precise your control over containers, the better you’ll sleep knowing your applications are secure, isolated, and ready for anything.

SELinuxAppArmorcontainerscontainersecurityprofilesAWSGCPCloudcloud securityDockerKubernetesSecurity