AppArmor (Application Armor) is a security module that allows a system administrator to associate a security profile with each program. Docker expects to find an AppArmor policy loaded and enforced.
Container profiles are loaded automatically by Docker. A profile for the Docker Engine itself also exists and is installed with the official .deb packages. Advanced users and package managers may find the profile for /usr/bin/docker underneath contrib/apparmor in the Docker Engine source repository.
The docker-default profile the default for running containers. It is moderately protective while providing wide application compatability.
The system's standard unconfined profile inherits all system-wide policies, applying path-based policies intended for the host system inside of containers. This was the default for privileged containers prior to Docker 1.8.
Users may override the AppArmor profile using the security-opt option (per-container).
For example, the following explicitly specifies the default policy:
$ docker run --rm -it --security-opt apparmor:docker-default hello-world