apparmor

Guide to sandboxing AI services on Linux with AppArmor, showing how to reduce attack surface around models, GPUs, files and networking without changing code. Covers enabling AppArmor, inventorying usage, drafting a minimal Python-friendly profile with read-only/mmap model dirs, iterating via logs and aa-logprof to enforce, and deploying via systemd, Docker or Kubernetes, plus GPU/device, temp, and troubleshooting tips.

Explore the key differences between AppArmor and SELinux, the primary security modules for Linux distributions. AppArmor, favored for its simplicity and ease of use, is standard in Ubuntu, while SELinux offers detailed, context-based security policies ideal for high-security environments and is predominantly used in RHEL. This analysis covers their policy designs, default configurations, and toolsets, catering to both novice and advanced users aiming to enhance system security management.