docker inspect contains no indication of default AppArmor profile #25935
Description
Docker is setting the default AppArmor profile, but docker inspect claims otherwise:
$ docker inspect container
[
{
...
"AppArmorProfile": "",
"SecurityOpt": [],
"State": {
"Pid": 14235,
...
}
...
}
]
$ sudo aa-status
...
18 processes are in enforce mode.
...
docker-default (14235)
If I explicitly set the default with --security-opt apparmor:docker-default, then docker inspect is correct.
Output of docker version:
Client:
Version: 1.12.0
API version: 1.24
Go version: go1.6.3
Git commit: 8eab29e
Built: Thu Jul 28 22:11:10 2016
OS/Arch: linux/amd64
Server:
Version: 1.12.0
API version: 1.24
Go version: go1.6.3
Git commit: 8eab29e
Built: Thu Jul 28 22:11:10 2016
OS/Arch: linux/amd64
Output of docker info:
Containers: 13
Running: 10
Paused: 0
Stopped: 3
Images: 14
Server Version: 1.12.0
Storage Driver: aufs
Root Dir: /var/lib/docker/aufs
Backing Filesystem: extfs
Dirs: 127
Dirperm1 Supported: true
Logging Driver: awslogs
Cgroup Driver: cgroupfs
Plugins:
Volume: local
Network: null host bridge overlay
Swarm: inactive
Runtimes: runc
Default Runtime: runc
Security Options: apparmor seccomp
Kernel Version: 4.4.0-31-generic
Operating System: Ubuntu 16.04.1 LTS
OSType: linux
Architecture: x86_64
CPUs: 2
Total Memory: 7.795 GiB
Name: moon-04643584d28c0ac31
ID: TWQW:NLZA:6TPG:DWU6:3MJZ:OETI:VE67:D5M4:6JWY:I2HJ:PCYQ:NB7T
Docker Root Dir: /var/lib/docker
Debug Mode (client): false
Debug Mode (server): false
Registry: https://index.docker.io/v1/
WARNING: No swap limit support
Insecure Registries:
127.0.0.0/8
Additional environment details (AWS, VirtualBox, physical, etc.):
AWS
Steps to reproduce the issue:
- Run a container on an AppArmor enabled host, without specifying a profile.
- Run docker inspect and compare to aa-status
Describe the results you received:
docker inspect does not include information about AppArmor profiles if the default profile is applied by docker.
Describe the results you expected:
docker inspect should always include the AppArmor profile, even if it's just the default.
Additional information you deem important (e.g. issue happens only occasionally):