@@ -75,6 +75,7 @@ type Opt struct {

 	Rootless            bool

 	IdentityMapping     *idtools.IdentityMapping

 	DNSConfig           config.DNSConfig

+	ApparmorProfile     string

 }

 // Builder can build using BuildKit backend

@@ -132,7 +132,7 @@ func newController(rt http.RoundTripper, opt Opt) (*control.Controller, error) {

 	dns := getDNSConfig(opt.DNSConfig)

-	exec, err := newExecutor(root, opt.DefaultCgroupParent, opt.NetworkController, dns, opt.Rootless, opt.IdentityMapping)

+	exec, err := newExecutor(root, opt.DefaultCgroupParent, opt.NetworkController, dns, opt.Rootless, opt.IdentityMapping, opt.ApparmorProfile)

 	if err != nil {

 		return nil, err

 	}

@@ -24,7 +24,7 @@ import (

 const networkName = "bridge"

-func newExecutor(root, cgroupParent string, net libnetwork.NetworkController, dnsConfig *oci.DNSConfig, rootless bool, idmap *idtools.IdentityMapping) (executor.Executor, error) {

+func newExecutor(root, cgroupParent string, net libnetwork.NetworkController, dnsConfig *oci.DNSConfig, rootless bool, idmap *idtools.IdentityMapping, apparmorProfile string) (executor.Executor, error) {

 	networkProviders := map[pb.NetMode]network.Provider{

 		pb.NetMode_UNSET: &bridgeProvider{NetworkController: net, Root: filepath.Join(root, "net")},

 		pb.NetMode_HOST:  network.NewHostProvider(),

@@ -38,6 +38,7 @@ func newExecutor(root, cgroupParent string, net libnetwork.NetworkController, dn

 		NoPivot:             os.Getenv("DOCKER_RAMDISK") != "",

 		IdentityMapping:     idmap,

 		DNS:                 dnsConfig,

+		ApparmorProfile:     apparmorProfile,

 	}, networkProviders)

 }

@@ -11,7 +11,7 @@ import (

 	"github.com/moby/buildkit/executor/oci"

 )

-func newExecutor(_, _ string, _ libnetwork.NetworkController, _ *oci.DNSConfig, _ bool, _ *idtools.IdentityMapping) (executor.Executor, error) {

+func newExecutor(_, _ string, _ libnetwork.NetworkController, _ *oci.DNSConfig, _ bool, _ *idtools.IdentityMapping, _ string) (executor.Executor, error) {

 	return &winExecutor{}, nil

 }

@@ -297,6 +297,7 @@ func newRouterOptions(config *config.Config, d *daemon.Daemon) (routerOptions, e

 		Rootless:            d.Rootless(),

 		IdentityMapping:     d.IdentityMapping(),

 		DNSConfig:           config.DNSConfig,

+		ApparmorProfile:     daemon.DefaultApparmorProfile(),

 	})

 	if err != nil {

 		return opts, err

@@ -15,6 +15,14 @@ const (

 	defaultAppArmorProfile    = "docker-default"

 )

+// DefaultApparmorProfile returns the name of the default apparmor profile

+func DefaultApparmorProfile() string {

+	if apparmor.IsEnabled() {

+		return defaultAppArmorProfile

+	}

+	return ""

+}

+

 func ensureDefaultAppArmorProfile() error {

 	if apparmor.IsEnabled() {

 		loaded, err := aaprofile.IsLoaded(defaultAppArmorProfile)

@@ -5,3 +5,8 @@ package daemon // import "github.com/docker/docker/daemon"

 func ensureDefaultAppArmorProfile() error {

 	return nil

 }

+

+// DefaultApparmorProfile returns an empty string.

+func DefaultApparmorProfile() string {

+	return ""

+}