profiles/apparmor, seccomp: migrate to separate module

Signed-off-by: Sebastiaan van Stijn <github@gone.nl> (cherry picked from commit a600da91f4) Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2026-01-11 10:41:43 +00:00 · 2025-07-22 17:13:44 +02:00
parent da489a11d4
commit b2f03f45ea
27 changed files with 516 additions and 2318 deletions
--- a/daemon/apparmor_default.go
+++ b/daemon/apparmor_default.go
@@ -6,7 +6,7 @@ import (
 	"fmt"

 	"github.com/containerd/containerd/v2/pkg/apparmor"
-	aaprofile "github.com/docker/docker/profiles/apparmor"
+	aaprofile "github.com/moby/profiles/apparmor"
 )

 // Define constants for native driver
--- a/daemon/seccomp_linux.go
+++ b/daemon/seccomp_linux.go
@@ -9,7 +9,7 @@ import (
 	"github.com/containerd/log"
 	"github.com/docker/docker/container"
 	dconfig "github.com/docker/docker/daemon/config"
-	"github.com/docker/docker/profiles/seccomp"
+	"github.com/moby/profiles/seccomp"
 	"github.com/opencontainers/runtime-spec/specs-go"
 )

--- a/daemon/seccomp_linux_test.go
+++ b/daemon/seccomp_linux_test.go
@@ -9,7 +9,7 @@ import (
 	dconfig "github.com/docker/docker/daemon/config"
 	"github.com/docker/docker/oci"
 	"github.com/docker/docker/pkg/sysinfo"
-	"github.com/docker/docker/profiles/seccomp"
+	"github.com/moby/profiles/seccomp"
 	"github.com/opencontainers/runtime-spec/specs-go"
 	"gotest.tools/v3/assert"
 )
--- a/integration-cli/docker_cli_run_unix_test.go
+++ b/integration-cli/docker_cli_run_unix_test.go
@@ -22,6 +22,7 @@ import (
 	"github.com/docker/docker/integration-cli/cli/build"
 	"github.com/docker/docker/pkg/sysinfo"
 	"github.com/docker/docker/testutil"
+	"github.com/moby/profiles/seccomp"
 	"github.com/moby/sys/mount"
 	"gotest.tools/v3/assert"
 	is "gotest.tools/v3/assert/cmp"
@@ -1319,7 +1320,16 @@ func (s *DockerCLIRunSuite) TestRunApparmorProcDirectory(c *testing.T) {
 func (s *DockerCLIRunSuite) TestRunSeccompWithDefaultProfile(c *testing.T) {
 	testRequires(c, testEnv.IsLocalDaemon, seccompEnabled)

-	out, _, err := dockerCmdWithError("run", "--security-opt", "seccomp=../profiles/seccomp/default.json", "debian:bookworm-slim", "unshare", "--map-root-user", "--user", "sh", "-c", "whoami")
+	// write the default profile to a file
+	b, err := json.MarshalIndent(seccomp.DefaultProfile(), "", "\t")
+	assert.NilError(c, err)
+
+	tmpDir := c.TempDir()
+	fileName := filepath.Join(tmpDir, "default.json")
+	err = os.WriteFile(fileName, b, 0o644)
+	assert.NilError(c, err)
+
+	out, _, err := dockerCmdWithError("run", "--security-opt", "seccomp="+fileName, "debian:bookworm-slim", "unshare", "--map-root-user", "--user", "sh", "-c", "whoami")
 	assert.ErrorContains(c, err, "", out)
 	assert.Equal(c, strings.TrimSpace(out), "unshare: unshare failed: Operation not permitted")
 }
--- a/oci/seccomp_test.go
+++ b/oci/seccomp_test.go
@@ -7,7 +7,7 @@ import (
 	"os"
 	"testing"

-	"github.com/docker/docker/profiles/seccomp"
+	"github.com/moby/profiles/seccomp"
 )

 func TestSeccompLoadProfile(t *testing.T) {
--- a/profiles/apparmor/apparmor_deprecated.go
+++ b/profiles/apparmor/apparmor_deprecated.go
@@ -0,0 +1,21 @@
+//go:build linux
+
+package apparmor
+
+import "github.com/moby/profiles/apparmor"
+
+// InstallDefault generates a default profile in a temp directory determined by
+// os.TempDir(), then loads the profile into the kernel using 'apparmor_parser'.
+//
+// Deprecated: use [apparmor.InstallDefault].
+func InstallDefault(name string) error {
+	return apparmor.InstallDefault(name)
+}
+
+// IsLoaded checks if a profile with the given name has been loaded into the
+// kernel.
+//
+// Deprecated: use [apparmor.IsLoaded].
+func IsLoaded(name string) (bool, error) {
+	return apparmor.IsLoaded(name)
+}
--- a/profiles/apparmor/apparmor_linux_test.go
+++ b/profiles/apparmor/apparmor_linux_test.go
@@ -1,197 +0,0 @@
-package apparmor
-
-import (
-	"errors"
-	"os"
-	"path"
-	"path/filepath"
-	"strings"
-	"testing"
-)
-
-// testAppArmorProfiles fixture "/sys/kernel/security/apparmor/profiles"
-// from an Ubuntu 24.10 host.
-const testAppArmorProfiles = `wpcom (unconfined)
-wike (unconfined)
-vpnns (unconfined)
-vivaldi-bin (unconfined)
-virtiofsd (unconfined)
-vdens (unconfined)
-uwsgi-core (unconfined)
-rsyslogd (enforce)
-/usr/lib/snapd/snap-confine (enforce)
-/usr/lib/snapd/snap-confine//mount-namespace-capture-helper (enforce)
-tcpdump (enforce)
-man_groff (enforce)
-man_filter (enforce)
-/usr/bin/man (enforce)
-userbindmount (unconfined)
-unprivileged_userns (enforce)
-unix-chkpwd (enforce)
-ubuntu_pro_esm_cache_systemd_detect_virt (enforce)
-ubuntu_pro_esm_cache_systemctl (enforce)
-ubuntu_pro_esm_cache (enforce)
-ubuntu_pro_esm_cache//ubuntu_distro_info (enforce)
-ubuntu_pro_esm_cache//ps (enforce)
-ubuntu_pro_esm_cache//dpkg (enforce)
-ubuntu_pro_esm_cache//cloud_id (enforce)
-ubuntu_pro_esm_cache//apt_methods_gpgv (enforce)
-ubuntu_pro_esm_cache//apt_methods (enforce)
-ubuntu_pro_apt_news (enforce)
-tuxedo-control-center (unconfined)
-tup (unconfined)
-trinity (unconfined)
-transmission-qt (complain)
-transmission-gtk (complain)
-transmission-daemon (complain)
-transmission-cli (complain)
-toybox (unconfined)
-thunderbird (unconfined)
-systemd-coredump (unconfined)
-surfshark (unconfined)
-stress-ng (unconfined)
-steam (unconfined)
-slirp4netns (unconfined)
-slack (unconfined)
-signal-desktop (unconfined)
-scide (unconfined)
-sbuild-upgrade (unconfined)
-sbuild-update (unconfined)
-sbuild-unhold (unconfined)
-sbuild-shell (unconfined)
-sbuild-hold (unconfined)
-sbuild-distupgrade (unconfined)
-sbuild-destroychroot (unconfined)
-sbuild-createchroot (unconfined)
-sbuild-clean (unconfined)
-sbuild-checkpackages (unconfined)
-sbuild-apt (unconfined)
-sbuild-adduser (unconfined)
-sbuild-abort (unconfined)
-sbuild (unconfined)
-runc (unconfined)
-rssguard (unconfined)
-rpm (unconfined)
-rootlesskit (unconfined)
-qutebrowser (unconfined)
-qmapshack (unconfined)
-qcam (unconfined)
-privacybrowser (unconfined)
-polypane (unconfined)
-podman (unconfined)
-plasmashell (enforce)
-plasmashell//QtWebEngineProcess (enforce)
-pageedit (unconfined)
-opera (unconfined)
-opam (unconfined)
-obsidian (unconfined)
-nvidia_modprobe (enforce)
-nvidia_modprobe//kmod (enforce)
-notepadqq (unconfined)
-nautilus (unconfined)
-msedge (unconfined)
-mmdebstrap (unconfined)
-lxc-usernsexec (unconfined)
-lxc-unshare (unconfined)
-lxc-stop (unconfined)
-lxc-execute (unconfined)
-lxc-destroy (unconfined)
-lxc-create (unconfined)
-lxc-attach (unconfined)
-lsb_release (enforce)
-loupe (unconfined)
-linux-sandbox (unconfined)
-libcamerify (unconfined)
-lc-compliance (unconfined)
-keybase (unconfined)
-kchmviewer (unconfined)
-ipa_verify (unconfined)
-goldendict (unconfined)
-github-desktop (unconfined)
-geary (unconfined)
-foliate (unconfined)
-flatpak (unconfined)
-firefox (unconfined)
-evolution (unconfined)
-epiphany (unconfined)
-element-desktop (unconfined)
-devhelp (unconfined)
-crun (unconfined)
-vscode (unconfined)
-chromium (unconfined)
-chrome (unconfined)
-ch-run (unconfined)
-ch-checkns (unconfined)
-cam (unconfined)
-busybox (unconfined)
-buildah (unconfined)
-brave (unconfined)
-balena-etcher (unconfined)
-Xorg (complain)
-QtWebEngineProcess (unconfined)
-MongoDB Compass (unconfined)
-Discord (unconfined)
-1password (unconfined)
-`
-
-func TestIsLoaded(t *testing.T) {
-	tmpDir := t.TempDir()
-	profiles := path.Join(tmpDir, "apparmor_profiles")
-	if err := os.WriteFile(profiles, []byte(testAppArmorProfiles), 0o644); err != nil {
-		t.Fatal(err)
-	}
-	t.Run("loaded", func(t *testing.T) {
-		found, err := isLoaded("busybox", profiles)
-		if err != nil {
-			t.Fatal(err)
-		}
-		if !found {
-			t.Fatal("expected profile to be loaded")
-		}
-	})
-	t.Run("not loaded", func(t *testing.T) {
-		found, err := isLoaded("no-such-profile", profiles)
-		if err != nil {
-			t.Fatal(err)
-		}
-		if found {
-			t.Fatal("expected profile to not be loaded")
-		}
-	})
-	t.Run("error", func(t *testing.T) {
-		_, err := isLoaded("anything", path.Join(tmpDir, "no_such_file"))
-		if err == nil || !errors.Is(err, os.ErrNotExist) {
-			t.Fatalf("expected error to be os.ErrNotExist, got %v", err)
-		}
-	})
-}
-
-func createTestProfiles(b *testing.B, lines int, targetProfile string) string {
-	b.Helper()
-
-	var sb strings.Builder
-	for i := 0; i < lines-1; i++ {
-		sb.WriteString("someprofile (enforcing)\n")
-	}
-	sb.WriteString(targetProfile + " (enforcing)\n")
-
-	fileName := filepath.Join(b.TempDir(), "apparmor_profiles")
-	if err := os.WriteFile(fileName, []byte(sb.String()), 0o644); err != nil {
-		b.Fatal(err)
-	}
-	return fileName
-}
-
-func BenchmarkIsLoaded(b *testing.B) {
-	const target = "myprofile"
-	profiles := createTestProfiles(b, 10000, target)
-
-	b.ReportAllocs()
-	b.ResetTimer()
-	for i := 0; i < b.N; i++ {
-		found, err := isLoaded(target, profiles)
-		if err != nil || !found {
-			b.Fatalf("expected profile to be found, got found=%v, err=%v", found, err)
-		}
-	}
-}
--- a/profiles/seccomp/fixtures/conditional_include.json
+++ b/profiles/seccomp/fixtures/conditional_include.json
@@ -1,23 +0,0 @@
-{
-  "defaultAction": "SCMP_ACT_ERRNO",
-  "syscalls": [
-    {
-      "names": ["chmod"],
-      "action": "SCMP_ACT_ALLOW"
-    },
-    {
-      "names": ["syslog"],
-      "action": "SCMP_ACT_ALLOW",
-      "includes": {
-        "caps": ["CAP_SYSLOG"]
-      }
-    },
-    {
-      "names": ["ptrace"],
-      "action": "SCMP_ACT_ALLOW",
-      "excludes": {
-        "caps": ["CAP_SYS_ADMIN"]
-      }
-    }
-  ]
-}
--- a/profiles/seccomp/fixtures/default-old-format.json
+++ b/profiles/seccomp/fixtures/default-old-format.json
--- a/profiles/seccomp/fixtures/example.json
+++ b/profiles/seccomp/fixtures/example.json
@@ -1,34 +0,0 @@
-{
-    "defaultAction": "SCMP_ACT_ERRNO",
-    "defaultErrnoRet": 1,
-    "syscalls": [
-        {
-            "name": "clone",
-            "action": "SCMP_ACT_ALLOW",
-            "args": [
-                {
-                    "index": 0,
-                    "value": 2114060288,
-                    "valueTwo": 0,
-                    "op": "SCMP_CMP_MASKED_EQ"
-                }
-            ]
-        },
-        {
-            "name": "open",
-            "action": "SCMP_ACT_ALLOW",
-            "args": []
-        },
-        {
-            "name": "close",
-            "action": "SCMP_ACT_ALLOW",
-            "args": []
-        },
-        {
-            "name": "syslog",
-            "action": "SCMP_ACT_ERRNO",
-            "errnoRet": 12345,
-            "args": []
-        }
-    ]
-}
--- a/profiles/seccomp/generate.go
+++ b/profiles/seccomp/generate.go
@@ -1,31 +0,0 @@
-//go:build ignore
-
-package main
-
-import (
-	"encoding/json"
-	"os"
-	"path/filepath"
-
-	"github.com/docker/docker/profiles/seccomp"
-)
-
-// saves the default seccomp profile as a json file so people can use it as a
-// base for their own custom profiles
-func main() {
-	wd, err := os.Getwd()
-	if err != nil {
-		panic(err)
-	}
-	f := filepath.Join(wd, "default.json")
-
-	// write the default profile to the file
-	b, err := json.MarshalIndent(seccomp.DefaultProfile(), "", "\t")
-	if err != nil {
-		panic(err)
-	}
-
-	if err := os.WriteFile(f, b, 0o644); err != nil {
-		panic(err)
-	}
-}
--- a/profiles/seccomp/kernel_linux_test.go
+++ b/profiles/seccomp/kernel_linux_test.go
@@ -1,120 +0,0 @@
-package seccomp
-
-import (
-	"fmt"
-	"testing"
-)
-
-func TestGetKernelVersion(t *testing.T) {
-	version, err := getKernelVersion()
-	if err != nil {
-		t.Fatal(err)
-	}
-	if version == nil {
-		t.Fatal("version is nil")
-	}
-	if version.Kernel == 0 {
-		t.Fatal("no kernel version")
-	}
-}
-
-// TestParseRelease tests the ParseRelease() function
-func TestParseRelease(t *testing.T) {
-	tests := []struct {
-		in          string
-		out         KernelVersion
-		expectedErr error
-	}{
-		{in: "3.8", out: KernelVersion{Kernel: 3, Major: 8}},
-		{in: "3.8.0", out: KernelVersion{Kernel: 3, Major: 8}},
-		{in: "3.8.0-19-generic", out: KernelVersion{Kernel: 3, Major: 8}},
-		{in: "3.4.54.longterm-1", out: KernelVersion{Kernel: 3, Major: 4}},
-		{in: "3.10.0-862.2.3.el7.x86_64", out: KernelVersion{Kernel: 3, Major: 10}},
-		{in: "3.12.8tag", out: KernelVersion{Kernel: 3, Major: 12}},
-		{in: "3.12-1-amd64", out: KernelVersion{Kernel: 3, Major: 12}},
-		{in: "3.12foobar", out: KernelVersion{Kernel: 3, Major: 12}},
-		{in: "99.999.999-19-generic", out: KernelVersion{Kernel: 99, Major: 999}},
-		{in: "", expectedErr: fmt.Errorf(`failed to parse kernel version "": EOF`)},
-		{in: "3", expectedErr: fmt.Errorf(`failed to parse kernel version "3": unexpected EOF`)},
-		{in: "3.", expectedErr: fmt.Errorf(`failed to parse kernel version "3.": EOF`)},
-		{in: "3a", expectedErr: fmt.Errorf(`failed to parse kernel version "3a": input does not match format`)},
-		{in: "3.a", expectedErr: fmt.Errorf(`failed to parse kernel version "3.a": expected integer`)},
-		{in: "a", expectedErr: fmt.Errorf(`failed to parse kernel version "a": expected integer`)},
-		{in: "a.a", expectedErr: fmt.Errorf(`failed to parse kernel version "a.a": expected integer`)},
-		{in: "a.a.a-a", expectedErr: fmt.Errorf(`failed to parse kernel version "a.a.a-a": expected integer`)},
-		{in: "-3", expectedErr: fmt.Errorf(`failed to parse kernel version "-3": expected integer`)},
-		{in: "-3.", expectedErr: fmt.Errorf(`failed to parse kernel version "-3.": expected integer`)},
-		{in: "-3.8", expectedErr: fmt.Errorf(`failed to parse kernel version "-3.8": expected integer`)},
-		{in: "-3.-8", expectedErr: fmt.Errorf(`failed to parse kernel version "-3.-8": expected integer`)},
-		{in: "3.-8", expectedErr: fmt.Errorf(`failed to parse kernel version "3.-8": expected integer`)},
-	}
-	for _, tc := range tests {
-		t.Run(tc.in, func(t *testing.T) {
-			version, err := parseRelease(tc.in)
-			if tc.expectedErr != nil {
-				if err == nil {
-					t.Fatal("expected an error")
-				}
-				if err.Error() != tc.expectedErr.Error() {
-					t.Fatalf("expected: %s, got: %s", tc.expectedErr, err)
-				}
-				return
-			}
-			if err != nil {
-				t.Fatal("unexpected error:", err)
-			}
-			if version == nil {
-				t.Fatal("version is nil")
-			}
-			if version.Kernel != tc.out.Kernel || version.Major != tc.out.Major {
-				t.Fatalf("expected: %d.%d, got: %d.%d", tc.out.Kernel, tc.out.Major, version.Kernel, version.Major)
-			}
-		})
-	}
-}
-
-func TestKernelGreaterEqualThan(t *testing.T) {
-	// Get the current kernel version, so that we can make test relative to that
-	v, err := getKernelVersion()
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	tests := []struct {
-		doc      string
-		in       KernelVersion
-		expected bool
-	}{
-		{
-			doc:      "same version",
-			in:       KernelVersion{v.Kernel, v.Major},
-			expected: true,
-		},
-		{
-			doc:      "kernel minus one",
-			in:       KernelVersion{v.Kernel - 1, v.Major},
-			expected: true,
-		},
-		{
-			doc:      "kernel plus one",
-			in:       KernelVersion{v.Kernel + 1, v.Major},
-			expected: false,
-		},
-		{
-			doc:      "major plus one",
-			in:       KernelVersion{v.Kernel, v.Major + 1},
-			expected: false,
-		},
-	}
-	for _, tc := range tests {
-		t.Run(tc.doc+": "+tc.in.String(), func(t *testing.T) {
-			ok, err := kernelGreaterEqualThan(tc.in)
-			if err != nil {
-				t.Fatal("unexpected error:", err)
-			}
-			if ok != tc.expected {
-				t.Fatalf("expected: %v, got: %v", tc.expected, ok)
-			}
-		})
-	}
-}
--- a/profiles/seccomp/seccomp_deprecated.go
+++ b/profiles/seccomp/seccomp_deprecated.go
@@ -0,0 +1,37 @@
+package seccomp
+
+import "github.com/moby/profiles/seccomp"
+
+// Seccomp represents the config for a seccomp profile for syscall restriction.
+// It is used to marshal/unmarshal the JSON profiles as accepted by docker, and
+// extends the runtime-spec's specs.LinuxSeccomp, overriding some fields to
+// provide the ability to define conditional rules based on the host's kernel
+// version, architecture, and the container's capabilities.
+//
+// Deprecated: use [seccomp.Seccomp].
+type Seccomp = seccomp.Seccomp
+
+// Architecture is used to represent a specific architecture
+// and its sub-architectures
+//
+// Deprecated: use [seccomp.Architecture].
+type Architecture = seccomp.Architecture
+
+// Filter is used to conditionally apply Seccomp rules
+//
+// Deprecated: use [seccomp.Filter].
+type Filter = seccomp.Filter
+
+// Syscall is used to match a group of syscalls in Seccomp. It extends the
+// runtime-spec Syscall type, adding a "Name" field for backward compatibility
+// with older JSON representations, additional "Comment" metadata, and conditional
+// rules ("Includes", "Excludes") used to generate a runtime-spec Seccomp profile
+// based on the container (capabilities) and host's (arch, kernel) configuration.
+//
+// Deprecated: use [seccomp.Syscall].
+type Syscall = seccomp.Syscall
+
+// KernelVersion holds information about the kernel.
+//
+// Deprecated: use [seccomp.KernelVersion].
+type KernelVersion = seccomp.KernelVersion
--- a/profiles/seccomp/seccomp_deprecated_linux.go
+++ b/profiles/seccomp/seccomp_deprecated_linux.go
@@ -0,0 +1,27 @@
+package seccomp
+
+import (
+	"github.com/moby/profiles/seccomp"
+	"github.com/opencontainers/runtime-spec/specs-go"
+)
+
+// DefaultProfile defines the allowed syscalls for the default seccomp profile.
+//
+// Deprecated: use [seccomp.DefaultProfile].
+func DefaultProfile() *seccomp.Seccomp {
+	return seccomp.DefaultProfile()
+}
+
+// GetDefaultProfile returns the default seccomp profile.
+//
+// Deprecated: use [seccomp.GetDefaultProfile].
+func GetDefaultProfile(rs *specs.Spec) (*specs.LinuxSeccomp, error) {
+	return seccomp.GetDefaultProfile(rs)
+}
+
+// LoadProfile takes a json string and decodes the seccomp profile.
+//
+// Deprecated: use [seccomp.LoadProfile].
+func LoadProfile(body string, rs *specs.Spec) (*specs.LinuxSeccomp, error) {
+	return seccomp.LoadProfile(body, rs)
+}
--- a/profiles/seccomp/seccomp_test.go
+++ b/profiles/seccomp/seccomp_test.go
@@ -1,314 +0,0 @@
-//go:build linux
-
-package seccomp
-
-import (
-	"encoding/json"
-	"os"
-	"reflect"
-	"strings"
-	"testing"
-
-	"github.com/opencontainers/runtime-spec/specs-go"
-)
-
-func assertDeepEqual(t *testing.T, expected interface{}, actual interface{}) {
-	t.Helper()
-	if !reflect.DeepEqual(expected, actual) {
-		t.Fatalf("\nexpected: %+#v\ngot     : %+#v", expected, actual)
-	}
-}
-
-func TestLoadProfile(t *testing.T) {
-	f, err := os.ReadFile("fixtures/example.json")
-	if err != nil {
-		t.Fatal(err)
-	}
-	rs := createSpec()
-	p, err := LoadProfile(string(f), &rs)
-	if err != nil {
-		t.Fatal(err)
-	}
-	var expectedErrno uint = 12345
-	var expectedDefaultErrno uint = 1
-	expected := specs.LinuxSeccomp{
-		DefaultAction:   specs.ActErrno,
-		DefaultErrnoRet: &expectedDefaultErrno,
-		Syscalls: []specs.LinuxSyscall{
-			{
-				Names:  []string{"clone"},
-				Action: specs.ActAllow,
-				Args: []specs.LinuxSeccompArg{{
-					Index:    0,
-					Value:    2114060288,
-					ValueTwo: 0,
-					Op:       specs.OpMaskedEqual,
-				}},
-			},
-			{
-				Names:  []string{"open"},
-				Action: specs.ActAllow,
-				Args:   []specs.LinuxSeccompArg{},
-			},
-			{
-				Names:  []string{"close"},
-				Action: specs.ActAllow,
-				Args:   []specs.LinuxSeccompArg{},
-			},
-			{
-				Names:    []string{"syslog"},
-				Action:   specs.ActErrno,
-				ErrnoRet: &expectedErrno,
-				Args:     []specs.LinuxSeccompArg{},
-			},
-		},
-	}
-
-	assertDeepEqual(t, expected, *p)
-}
-
-func TestLoadProfileWithDefaultErrnoRet(t *testing.T) {
-	profile := []byte(`{
-"defaultAction": "SCMP_ACT_ERRNO",
-"defaultErrnoRet": 6
-}`)
-	rs := createSpec()
-	p, err := LoadProfile(string(profile), &rs)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	expectedErrnoRet := uint(6)
-	expected := specs.LinuxSeccomp{
-		DefaultAction:   specs.ActErrno,
-		DefaultErrnoRet: &expectedErrnoRet,
-	}
-
-	assertDeepEqual(t, expected, *p)
-}
-
-func TestLoadProfileWithListenerPath(t *testing.T) {
-	profile := []byte(`{
-"defaultAction": "SCMP_ACT_ERRNO",
-"listenerPath": "/var/run/seccompaget.sock",
-"listenerMetadata": "opaque-metadata"
-}`)
-	rs := createSpec()
-	p, err := LoadProfile(string(profile), &rs)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	expected := specs.LinuxSeccomp{
-		DefaultAction:    specs.ActErrno,
-		ListenerPath:     "/var/run/seccompaget.sock",
-		ListenerMetadata: "opaque-metadata",
-	}
-
-	assertDeepEqual(t, expected, *p)
-}
-
-func TestLoadProfileWithFlag(t *testing.T) {
-	profile := `{"defaultAction": "SCMP_ACT_ERRNO", "flags": ["SECCOMP_FILTER_FLAG_SPEC_ALLOW", "SECCOMP_FILTER_FLAG_LOG"]}`
-	expected := specs.LinuxSeccomp{
-		DefaultAction: specs.ActErrno,
-		Flags:         []specs.LinuxSeccompFlag{"SECCOMP_FILTER_FLAG_SPEC_ALLOW", "SECCOMP_FILTER_FLAG_LOG"},
-	}
-	rs := createSpec()
-	p, err := LoadProfile(profile, &rs)
-	if err != nil {
-		t.Fatal(err)
-	}
-	assertDeepEqual(t, expected, *p)
-}
-
-// TestLoadProfileValidation tests that invalid profiles produce the correct error.
-func TestLoadProfileValidation(t *testing.T) {
-	tests := []struct {
-		doc      string
-		profile  string
-		expected string
-	}{
-		{
-			doc:      "conflicting architectures and archMap",
-			profile:  `{"defaultAction": "SCMP_ACT_ERRNO", "architectures": ["A", "B", "C"], "archMap": [{"architecture": "A", "subArchitectures": ["B", "C"]}]}`,
-			expected: `both 'architectures' and 'archMap' are specified in the seccomp profile, use either 'architectures' or 'archMap'`,
-		},
-		{
-			doc:      "conflicting syscall.name and syscall.names",
-			profile:  `{"defaultAction": "SCMP_ACT_ERRNO", "syscalls": [{"name": "accept", "names": ["accept"], "action": "SCMP_ACT_ALLOW"}]}`,
-			expected: `both 'name' and 'names' are specified in the seccomp profile, use either 'name' or 'names'`,
-		},
-	}
-	for _, tc := range tests {
-		rs := createSpec()
-		t.Run(tc.doc, func(t *testing.T) {
-			_, err := LoadProfile(tc.profile, &rs)
-			if err == nil {
-				t.Fatal("expected error")
-			}
-			if tc.expected != err.Error() {
-				t.Fatalf("expected: %q, got: %q", tc.expected, err)
-			}
-		})
-	}
-}
-
-// TestLoadLegacyProfile tests loading a seccomp profile in the old format
-// (before https://github.com/docker/docker/pull/24510)
-func TestLoadLegacyProfile(t *testing.T) {
-	f, err := os.ReadFile("fixtures/default-old-format.json")
-	if err != nil {
-		t.Fatal(err)
-	}
-	rs := createSpec()
-	p, err := LoadProfile(string(f), &rs)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if p.DefaultAction != specs.ActErrno {
-		t.Fatalf("expected default action %s, got %s", specs.ActErrno, p.DefaultAction)
-	}
-	expectedArches := []specs.Arch{"SCMP_ARCH_X86_64", "SCMP_ARCH_X86", "SCMP_ARCH_X32"}
-	assertDeepEqual(t, expectedArches, p.Architectures)
-
-	if expected := 311; len(p.Syscalls) != expected {
-		t.Fatalf("expected %d syscalls, got %d", expected, len(p.Syscalls))
-	}
-	expected := specs.LinuxSyscall{
-		Names:  []string{"accept"},
-		Action: specs.ActAllow,
-		Args:   []specs.LinuxSeccompArg{},
-	}
-	assertDeepEqual(t, expected, p.Syscalls[0])
-}
-
-func TestLoadDefaultProfile(t *testing.T) {
-	f, err := os.ReadFile("default.json")
-	if err != nil {
-		t.Fatal(err)
-	}
-	rs := createSpec()
-	if _, err := LoadProfile(string(f), &rs); err != nil {
-		t.Fatal(err)
-	}
-}
-
-func TestUnmarshalDefaultProfile(t *testing.T) {
-	expected := DefaultProfile()
-	if expected == nil {
-		t.Skip("seccomp not supported")
-	}
-
-	f, err := os.ReadFile("default.json")
-	if err != nil {
-		t.Fatal(err)
-	}
-	var profile Seccomp
-	err = json.Unmarshal(f, &profile)
-	if err != nil {
-		t.Fatal(err)
-	}
-	assertDeepEqual(t, expected.Architectures, profile.Architectures)
-	assertDeepEqual(t, expected.ArchMap, profile.ArchMap)
-	assertDeepEqual(t, expected.DefaultAction, profile.DefaultAction)
-	assertDeepEqual(t, expected.Syscalls, profile.Syscalls)
-}
-
-func TestMarshalUnmarshalFilter(t *testing.T) {
-	t.Parallel()
-	tests := []struct {
-		in    string
-		out   string
-		error bool
-	}{
-		{in: `{"arches":["s390x"],"minKernel":3}`, error: true},
-		{in: `{"arches":["s390x"],"minKernel":3.12}`, error: true},
-		{in: `{"arches":["s390x"],"minKernel":true}`, error: true},
-		{in: `{"arches":["s390x"],"minKernel":"0.0"}`, error: true},
-		{in: `{"arches":["s390x"],"minKernel":"3"}`, error: true},
-		{in: `{"arches":["s390x"],"minKernel":".3"}`, error: true},
-		{in: `{"arches":["s390x"],"minKernel":"3."}`, error: true},
-		{in: `{"arches":["s390x"],"minKernel":"true"}`, error: true},
-		{in: `{"arches":["s390x"],"minKernel":"3.12.1\""}`, error: true},
-		{in: `{"arches":["s390x"],"minKernel":"4.15abc"}`, error: true},
-		{in: `{"arches":["s390x"],"minKernel":null}`, out: `{"arches":["s390x"]}`},
-		{in: `{"arches":["s390x"],"minKernel":""}`, out: `{"arches":["s390x"],"minKernel":""}`}, // FIXME: try to fix omitempty for this
-		{in: `{"arches":["s390x"],"minKernel":"0.5"}`, out: `{"arches":["s390x"],"minKernel":"0.5"}`},
-		{in: `{"arches":["s390x"],"minKernel":"0.50"}`, out: `{"arches":["s390x"],"minKernel":"0.50"}`},
-		{in: `{"arches":["s390x"],"minKernel":"5.0"}`, out: `{"arches":["s390x"],"minKernel":"5.0"}`},
-		{in: `{"arches":["s390x"],"minKernel":"50.0"}`, out: `{"arches":["s390x"],"minKernel":"50.0"}`},
-		{in: `{"arches":["s390x"],"minKernel":"4.15"}`, out: `{"arches":["s390x"],"minKernel":"4.15"}`},
-	}
-	for _, tc := range tests {
-		t.Run(tc.in, func(t *testing.T) {
-			var filter Filter
-			err := json.Unmarshal([]byte(tc.in), &filter)
-			if tc.error {
-				if err == nil {
-					t.Fatal("expected an error")
-				} else if !strings.Contains(err.Error(), "invalid kernel version") {
-					t.Fatal("unexpected error:", err)
-				}
-				return
-			}
-			if err != nil {
-				t.Fatal(err)
-			}
-			out, err := json.Marshal(filter)
-			if err != nil {
-				t.Fatal(err)
-			}
-			if string(out) != tc.out {
-				t.Fatalf("expected %s, got %s", tc.out, string(out))
-			}
-		})
-	}
-}
-
-func TestLoadConditional(t *testing.T) {
-	f, err := os.ReadFile("fixtures/conditional_include.json")
-	if err != nil {
-		t.Fatal(err)
-	}
-	tests := []struct {
-		doc      string
-		cap      string
-		expected []string
-	}{
-		{doc: "no caps", expected: []string{"chmod", "ptrace"}},
-		{doc: "with syslog", cap: "CAP_SYSLOG", expected: []string{"chmod", "syslog", "ptrace"}},
-		{doc: "no ptrace", cap: "CAP_SYS_ADMIN", expected: []string{"chmod"}},
-	}
-
-	for _, tc := range tests {
-		t.Run(tc.doc, func(t *testing.T) {
-			rs := createSpec(tc.cap)
-			p, err := LoadProfile(string(f), &rs)
-			if err != nil {
-				t.Fatal(err)
-			}
-			if len(p.Syscalls) != len(tc.expected) {
-				t.Fatalf("expected %d syscalls in profile, have %d", len(tc.expected), len(p.Syscalls))
-			}
-			for i, v := range p.Syscalls {
-				if v.Names[0] != tc.expected[i] {
-					t.Fatalf("expected %s syscall, have %s", tc.expected[i], v.Names[0])
-				}
-			}
-		})
-	}
-}
-
-// createSpec() creates a minimum spec for testing
-func createSpec(caps ...string) specs.Spec {
-	rs := specs.Spec{
-		Process: &specs.Process{
-			Capabilities: &specs.LinuxCapabilities{},
-		},
-	}
-	if caps != nil {
-		rs.Process.Capabilities.Bounding = append(rs.Process.Capabilities.Bounding, caps...)
-	}
-	return rs
-}
--- a/vendor.mod
+++ b/vendor.mod
@@ -68,6 +68,8 @@ require (
 	github.com/moby/ipvs v1.1.0
 	github.com/moby/locker v1.0.1
 	github.com/moby/patternmatcher v0.6.0
+	github.com/moby/profiles/apparmor v0.1.0
+	github.com/moby/profiles/seccomp v0.1.0
 	github.com/moby/pubsub v1.0.0
 	github.com/moby/swarmkit/v2 v2.0.0
 	github.com/moby/sys/atomicwriter v0.1.0
--- a/vendor.sum
+++ b/vendor.sum
@@ -396,6 +396,10 @@ github.com/moby/locker v1.0.1 h1:fOXqR41zeveg4fFODix+1Ch4mj/gT0NE1XJbp/epuBg=
 github.com/moby/locker v1.0.1/go.mod h1:S7SDdo5zpBK84bzzVlKr2V0hz+7x9hWbYC/kq7oQppc=
 github.com/moby/patternmatcher v0.6.0 h1:GmP9lR19aU5GqSSFko+5pRqHi+Ohk1O69aFiKkVGiPk=
 github.com/moby/patternmatcher v0.6.0/go.mod h1:hDPoyOpDY7OrrMDLaYoY3hf52gNCR/YOUYxkhApJIxc=
+github.com/moby/profiles/apparmor v0.1.0 h1:dMUt6fqdOeU9tfKjntPN9hBY1C5tJtsUWZNiIuHK8QM=
+github.com/moby/profiles/apparmor v0.1.0/go.mod h1:2iRxPw+MrPuDvmb5lAEAeLB1kcOt7AzZeW3paBs2TQY=
+github.com/moby/profiles/seccomp v0.1.0 h1:kVf1lc5ytNB1XPxEdZUVF+oPpbBYJHR50eEvPt/9k8A=
+github.com/moby/profiles/seccomp v0.1.0/go.mod h1:Kqk57vxH6/wuOc5bmqRiSXJ6iEz8Pvo3LQRkv0ytFWs=
 github.com/moby/pubsub v1.0.0 h1:jkp/imWsmJz2f6LyFsk7EkVeN2HxR/HTTOY8kHrsxfA=
 github.com/moby/pubsub v1.0.0/go.mod h1:bXSO+3h5MNXXCaEG+6/NlAIk7MMZbySZlnB+cUQhKKc=
 github.com/moby/swarmkit/v2 v2.0.0 h1:jkWQKQaJ4ltA61/mC9UdPe1McLma55RUcacTO+pPweY=
--- a/vendor/github.com/moby/profiles/apparmor/LICENSE
+++ b/vendor/github.com/moby/profiles/apparmor/LICENSE
@@ -0,0 +1,202 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
--- a/vendor/github.com/moby/profiles/apparmor/apparmor.go
+++ b/vendor/github.com/moby/profiles/apparmor/apparmor.go
--- a/vendor/github.com/moby/profiles/apparmor/template.go
+++ b/vendor/github.com/moby/profiles/apparmor/template.go
@@ -6,7 +6,6 @@ package apparmor
 //       change to this profile, please make follow-up PRs to those projects so
 //       that these rules can be synchronised (because any issue with this
 //       profile will likely affect libpod and containerd).
-// TODO: Move this to a common project so we can maintain it in one spot.

 // baseTemplate defines the default apparmor profile for containers.
 const baseTemplate = `
--- a/vendor/github.com/moby/profiles/seccomp/LICENSE
+++ b/vendor/github.com/moby/profiles/seccomp/LICENSE
@@ -0,0 +1,202 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
--- a/vendor/github.com/moby/profiles/seccomp/default.json
+++ b/vendor/github.com/moby/profiles/seccomp/default.json
--- a/vendor/github.com/moby/profiles/seccomp/default_linux.go
+++ b/vendor/github.com/moby/profiles/seccomp/default_linux.go
--- a/vendor/github.com/moby/profiles/seccomp/kernel_linux.go
+++ b/vendor/github.com/moby/profiles/seccomp/kernel_linux.go
--- a/vendor/github.com/moby/profiles/seccomp/seccomp.go
+++ b/vendor/github.com/moby/profiles/seccomp/seccomp.go
--- a/vendor/github.com/moby/profiles/seccomp/seccomp_linux.go
+++ b/vendor/github.com/moby/profiles/seccomp/seccomp_linux.go
--- a/vendor/modules.txt
+++ b/vendor/modules.txt
@@ -942,6 +942,12 @@ github.com/moby/locker
 ## explicit; go 1.19
 github.com/moby/patternmatcher
 github.com/moby/patternmatcher/ignorefile
+# github.com/moby/profiles/apparmor v0.1.0
+## explicit; go 1.23.0
+github.com/moby/profiles/apparmor
+# github.com/moby/profiles/seccomp v0.1.0
+## explicit; go 1.23.0
+github.com/moby/profiles/seccomp
 # github.com/moby/pubsub v1.0.0
 ## explicit; go 1.19
 github.com/moby/pubsub