Investigate further security options

[shepmaster]

• gaol
• seccomp
• apparmor
• docker-bench-security
• docker-security-selinux

[ArtemGr]

With AppArmor you can add hats to a Docker profile.
cf. http://wiki.apparmor.net/index.php/AppArmor_Core_Policy_Reference#Local_Profiles_and_Hats
Having a hat in profile allows you to switch into that hat programmatically.

This is very good for security, because when you're switching into a hat, your app is already loaded, so there's no need to grant any access to the executable, to the shared libraries, to the filesystem in general.

I'm not sure it'll work though, as you need some kernel access in order to ask it to switch into a different hat, and Docker might be inadvertently blocking it.

Another option is to try something simpler, the usual subprofiles. Haven't tried it myself either, but I suppose it should work.