Compose service runs unconfined (seccomp or AppArmor disabled)

A Docker Compose service turns off one of the kernel confinement profiles through security_opt. seccomp:unconfined removes the syscall filter that blocks most of the kernel’s attack surface from the container, and apparmor:unconfined removes the mandatory access control profile. Both are usually switched off to make one syscall work, and both give up the confinement for every other call as well.

Reported:

Keep the default profile, or supply a profile that permits exactly what the service needs: