From b26094ed393b0cd91a91eef106e6a7860a2e9673 Mon Sep 17 00:00:00 2001 From: Zach Corleissen Date: Fri, 10 Nov 2017 13:41:00 -0600 Subject: [PATCH] Document unconfined apparmor profile (#6269) --- docs/tutorials/clusters/apparmor.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/docs/tutorials/clusters/apparmor.md b/docs/tutorials/clusters/apparmor.md index 81301a9b8a..f61186b626 100644 --- a/docs/tutorials/clusters/apparmor.md +++ b/docs/tutorials/clusters/apparmor.md @@ -132,6 +132,7 @@ specifies the profile to apply. The `profile_ref` can be one of: * `runtime/default` to apply the runtime's default profile * `localhost/` to apply the profile loaded on the host with the name `` +* `unconfined` to indicate that no profiles will be loaded See the [API Reference](#api-reference) for the full details on the annotation and profile name formats. @@ -410,6 +411,7 @@ Specifying the profile a container will run with: - `localhost/`: Refers to a profile loaded on the node (localhost) by name. - The possible profile names are detailed in the [core policy reference](http://wiki.apparmor.net/index.php/AppArmor_Core_Policy_Reference#Profile_names_and_attachment_specifications). +- `unconfined`: This effectively disables AppArmor on the container. Any other profile reference format is invalid.