Q: A security audit highlights that Docker's default seccomp profile allows over 300 system calls, including dangerous syscalls like `ptrace`, `bpf`, `keyctl`, and `perf_event_open` that have historically been exploited for kernel privilege escalation. For your public-facing Nginx reverse proxy and payment processing microservices, you must craft strict, least-privilege seccomp profiles that block unnecessary kernel interfaces, and deploy an AppArmor profile preventing unauthorized file access and raw socket creation.

Trace the actual system calls executed by your microservice during startup and peak simulated workload using `strace` or BCC/bpftrace `syscount` to establish an accurate whitelist baseline.

# Trace all unique system calls executed by the application
strace -c -f -p $(docker inspect --format '{{.State.Pid}}' web-app) -- sleep 30

# Or run application under strace to capture bootstrap syscalls
docker run --rm web-app:latest strace -ff -e trace=all /app/binary 2>&1 | awk -F'(' '{print $1}' | sort -u

Create a least-privilege Seccomp profile setting `defaultAction: SCMP_ACT_ERRNO` (blocking everything by default) and explicitly allowing only essential syscalls (`read`, `write`, `epoll_wait`, `futex`, `clone3`, etc.).

{
  "defaultAction": "SCMP_ACT_ERRNO",
  "architectures": [
    "SCMP_ARCH_X86_64",
    "SCMP_ARCH_AARCH64"
  ],
  "syscalls": [
    {
      "names": [
        "read", "write", "openat", "close", "stat", "fstat",
        "lseek", "mmap", "mprotect", "munmap", "brk", "rt_sigaction",
        "rt_sigprocmask", "ioctl", "nanosleep", "epoll_create1",
        "epoll_ctl", "epoll_wait", "clone3", "futex", "exit_group"
      ],
      "action": "SCMP_ACT_ALLOW"
    }
  ]
}

Run the container referencing the custom seccomp profile with `--security-opt seccomp=profile.json`. Test that prohibited syscalls (e.g., `sys_ptrace` or `sys_chroot`) are instantly rejected with `EPERM`.

# Run container with custom seccomp profile
docker run -d \
  --name hardened-api \
  --security-opt seccomp=./strict-seccomp.json \
  my-api:v1.0

# Test blocked syscall behavior inside the container
docker exec -it hardened-api strace -e ptrace ls
# Output: ptrace: Operation not permitted

Deploy an AppArmor profile in `/etc/apparmor.d/docker-nginx-hardened` to restrict file read/write access strictly to `/etc/nginx` and `/usr/share/nginx/html`, denying execution of `/bin/sh` or `/usr/bin/curl`.

# Load AppArmor profile into kernel
sudo apparmor_parser -r -W /etc/apparmor.d/docker-nginx-hardened

# Run container enforcing the AppArmor profile
docker run -d \
  --security-opt apparmor=docker-nginx-hardened \
  nginx:alpine