Using a custom AppArmor profile

AppArmor lets a system administrator restrict capabilities of a deployed container by using custom profiles. In some cases, you might have to apply a custom profile to your deployed container to customize its capabilities.

To customize the AppArmor profile:

1. Create the profile on the cluster where you are deploying your migrated container. See the AppArmor documentation for more information.

2. Edit the deployment_spec.yaml file to add the HC_APPARMOR_PROFILE environment variable with the name of the AppArmor profile:

   spec:
     containers:
     - image: gcr.io/my-project/my-container:v1.0.0
       name: my-container
       env:
       - name: HC_APPARMOR_PROFILE
         value: "apparmor-profile-name"
       securityContext:
         privileged: true
   ...
   

   See Reviewing generated deployment files for more on editing deployment_spec.yaml.