Compatibility

Tested on these Docker hosts:

Docker host	Requires
Ubuntu >= 22.04	-
WSL2, Ubuntu >= 22.04	AppArmor in the LSM list

AppArmor on WSL2

The cage is started with an apparmor option, so WSL2 needs AppArmor in its LSM list. The stock WSL2 kernel supports it.

1. (Windows) Add the LSM list to %UserProfile%\.wslconfig:

   [wsl2]
   kernelCommandLine = lsm=apparmor,bpf,integrity,landlock,loadpin,lockdown,safesetid,selinux,tomoyo,yama

2. (WSL) Open /etc/fstab:

   sudo nano /etc/fstab

   Add the securityfs mount:

   none  /sys/kernel/security  securityfs  defaults  0  0
   

3. (WSL) Reload systemd, so it picks up the new mount unit:

   sudo systemctl daemon-reload

4. (Windows) Restart WSL2 in PowerShell or cmd, then open a new shell:

   wsl --shutdown

5. (WSL) Check the result, which lists the enabled LSMs in order:

   cat /sys/kernel/security/lsm