Is there a way to add custom security_opts to applications?

Apps and Virtualization
,
1

I have an app that requires the below settings in order to work.

environment:
      - ENABLE_NETWORK_MOUNT_MASKING=true # <-- enables the workaround

cap_add:
      - SYS_ADMIN                         # <-- required to perform the overlay mount

security_opt:
      - apparmor:unconfined               # <-- required to perform the overlay mount

The only one I cannot set in the application configuration page is the apparmor security_opt value. Is there a way to set it? If not, is there an easy way to convert the app into a custom app that uses docker compose for its configuration? I spend a lot of time configuring the app and I don’t want to lose its configuration, which is stored in the default application ixsystems storage locations.

I’m running TN Scale 25.10.7.

2

I don’t use anything but custom apps so I don’t know if there is a way to do what you want within those boundaries, but I do know that you can convert a normal app into a custom one like this:

3

catalog ui wont take apparmor:unconfined. convert it and stick that in the yaml.

Apps → that app → ⋮ beside Edit → Convert to custom app → Confirm

then Edit, find the service block and add:

security_opt:
  - apparmor:unconfined

leave ur cap_add + ENABLE_NETWORK_MOUNT_MASKING alone. save and start.

the ix host paths stay put so the config u already tuned keeps working. if u wanna peek first:

-midclt call app.config APPNAME

4

That worked. I had to fiddle with the some container specific settings to get the application to work the way that I wanted to, but the mount overlay is solid with the new permissions.