docker-network

#include <tunables/global>

profile docker-network flags=(attach_disconnected,mediate_deleted) {
    #include <abstractions/base>

    network,

    file,
    umount,

    deny /bin/** wl,
    deny /boot/** wl,
    deny /dev/** wl,
    deny /etc/** wl,
    deny /home/** wl,
    deny /lib/** wl,
    deny /lib64/** wl,
    deny /media/** wl,
    deny /mnt/** wl,
    deny /opt/** wl,
    deny /proc/** wl,
    deny /root/** wl,
    deny /sbin/** wl,
    deny /srv/** wl,
    deny /tmp/** wl,
    deny /sys/** wl,
    deny /usr/** wl,

    audit /** w,

    capability chown,
    capability dac_override,
    capability setuid,
    capability setgid,
    capability net_bind_service,
    capability net_broadcast,
    capability net_admin,
    capability net_raw,

    deny @{PROC}/* w,
    deny @{PROC}/{[^1-9],[^1-9][^0-9],[^1-9s][^0-9y][^0-9s],[^1-9][^0-9][^0-9][^0-9]*}/** w,
    deny @{PROC}/sys/[^k]** w,
    deny @{PROC}/sys/kernel/{?,??,[^s][^h][^m]**} w,
    deny @{PROC}/sysrq-trigger rwklx,
    deny @{PROC}/mem rwklx,
    deny @{PROC}/kmem rwklx,
    deny @{PROC}/kcore rwklx,
    deny mount,
    deny /sys/[^f]*/** wklx,
    deny /sys/f[^s]*/** wklx,
    deny /sys/fs/[^c]*/** wklx,
    deny /sys/fs/c[^g]*/** wklx,
    deny /sys/fs/cg[^r]*/** wklx,
    deny /sys/firmware/efi/efivars/** rwklx,
    deny /sys/kernel/security/** rwklx,
}