doc: what docker-default forbids, and how a compose service opts out

The page said what is confined but not what confinement costs. Three
denials in moby's template reach ordinary containers: mount, writes below
/sys, and sysctl -w from the inside. That hits deployments through
cuos-iac hardest - sysfs GPIO on the boards, FUSE, systemd as PID 1 - and
cap_add: [SYS_ADMIN] does not lift any of it, which is the part that
surprises.

security_opt in the compose file is the per-service way out, and unlike
the app image's label it adds rather than replaces.

Also corrected: every container dockerd starts gets docker-default, not
just the application container; unix-chkpwd ships in complain mode; and
the ~100 profiles of the apparmor package cannot deny anything, which is
the answer to whether they should be deleted.

Read off the packages in trixie - apparmor 4.1.0-1, isc-dhcp-client
4.4.3-P1-8 - and moby's template.go at v26.1.5. Not re-checked against a
booted system beyond aa-status showing docker-default, dhclient and
lsb_release loaded.

Signed-off-by: Simon Walz <contact@simonwalz.de>

Author: simonwalz

docs/common/apparmor.md

@@ -8,14 +8,20 @@ every platform except LXC. `cuos selftest` reports the state under the
 
 | | Profile | Where it comes from |
 |---|---|---|
-| The application container | `docker-default` | dockerd's built-in template, loaded when the daemon starts |
+| Every container dockerd starts | `docker-default` | dockerd's built-in template, loaded when the daemon starts |
 | `dhclient` | `/usr/sbin/dhclient` | Debian's `isc-dhcp-client` package |
-| PAM's password check | `unix-chkpwd` | Debian's `apparmor` package |
+| PAM's password check | `unix-chkpwd`, in complain mode | Debian's `apparmor` package |
 
 That is the whole list, and `docker-default` is the point of the exercise: it is
-what stands between the application container and the host. Debian's
-`apparmor-profiles` and `apparmor-profiles-extra` packages are not installed —
-they cover samba, syslog, avahi and desktop software, none of which is here.
+what stands between a container and the host — the application container and
+everything deployed through cuos-iac alike. Debian's `apparmor-profiles` and
+`apparmor-profiles-extra` packages are not installed — they cover samba,
+syslog, avahi and desktop software, none of which is here.
+
+The `apparmor` package's own ~100 profiles are inert here: most are the Debian
+13 userns stubs (`flags=(unconfined)`, body `userns,`), and every one of the
+rest is either in complain mode or carries no attachment path. None of them can
+deny anything, including inside a container that runs unconfined.
 
 ## What is not confined
 
@@ -32,11 +38,57 @@ they cover samba, syslog, avahi and desktop software, none of which is here.
   Confining a CuOS guest is the LXC host's business.
 - **The installer ISO.** A separate image without the AppArmor package.
 
+## What `docker-default` forbids a container
+
+The profile is permissive by design: `network,`, `capability,`, `file,` and
+`umount,` are allowed outright, so every file and every capability is on the
+table. What it carries is a short list of denials, and three of them reach
+ordinary containers.
+
+| Denied | What stops working |
+|---|---|
+| `deny mount,` | FUSE (sshfs, s3fs, rclone), `mount --bind` in an entrypoint, NFS/CIFS from inside, docker-in-docker, systemd as PID 1 |
+| writes below `/sys`, everything but `/sys/fs/cgroup/**` | sysfs GPIO (`/sys/class/gpio/export`), LEDs, PWM, backlight, driver `bind`/`unbind`, `/sys/class/net/*` |
+| `deny @{PROC}/sys/[^k]** w,` | `sysctl -w` run inside the container |
+
+Reading is untouched — only writes to `/sys` and `/proc` are denied.
+
+**`cap_add: [SYS_ADMIN]` does not lift any of this.** The capability is granted
+and AppArmor refuses anyway, and the error names neither. `privileged: true`
+does lift it, because Docker runs privileged containers unconfined.
+
+Unaffected, and usually the cheaper way out of a denial:
+
+- `volumes:`, `tmpfs:`, `read_only:` and `sysctls:` in a compose file — runc
+  applies those before the container starts, and runc is unconfined.
+- Device nodes: `/dev/gpiochip*` (libgpiod), `/dev/i2c-*`, `/dev/spidev*` are
+  covered by `file,`. Only the sysfs route to the same hardware is denied.
+
+`docker-default` separates a container from the **host**, not from other
+containers. Every container carries the same profile name, so the
+`signal (send,receive) peer=docker-default` and
+`ptrace (trace,read) peer=docker-default` rules of the template apply between
+containers as soon as they share a PID namespace (`pid: host`,
+`pid: service:…`).
+
+The rules above are moby's built-in template as of 26.1.5, the version in
+Debian trixie's `docker.io`. Read `aa-status` on the device rather than this
+page if a denial does not match.
+
 ## Giving an application more than `docker-default`
 
-The flags of the application container come from the `dev.cuos.app_command`
-label on the app image (see `cuos-app-init.md`), so the profile is selected
-there:
+For a service deployed through cuos-iac, the profile is chosen per service in
+the compose file, and adds to what is already there:
+
+```yml
+services:
+  app:
+    security_opt:
+      - apparmor=unconfined
+```
+
+For the application container, the flags come from the `dev.cuos.app_command`
+label on the app image (see `cuos-app-init.md`), so it is selected there:
 
 ```
 LABEL dev.cuos.app_command="--security-opt apparmor=my-profile ..."
@@ -45,8 +97,9 @@ LABEL dev.cuos.app_command="--security-opt apparmor=my-profile ..."
 Note that the label **replaces** the default flag set rather than adding to it.
 
 The profile itself has to be loaded into the kernel before the container
-starts, and CuOS ships no mechanism for that yet. While an application is being
-brought up, `--security-opt apparmor=unconfined` is the escape hatch.
+starts, and CuOS ships no mechanism for that yet. So the choice today is
+`docker-default` or nothing: while an application is being brought up,
+`--security-opt apparmor=unconfined` is the escape hatch.
 
 ## Reading a denial