code: func WithApparmor(c *container.Container) coci.SpecOpts {
  	return func(ctx context.Context, _ coci.Client, _ *containers.Container, s *coci.Spec) error {
  		if apparmor.IsEnabled() {
  			var appArmorProfile string
  			if c.AppArmorProfile != "" {
  				appArmorProfile = c.AppArmorProfile
  			} else if c.HostConfig.Privileged {
  				appArmorProfile = "unconfined"
  			} else {
  				appArmorProfile = "docker-default"
  			}
  
  			if appArmorProfile == "docker-default" {
  				// Unattended upgrades and other fun services can unload AppArmor
  				// profiles inadvertently. Since we cannot store our profile in
  				// /etc/apparmor.d, nor can we practically add other ways of
  				// telling the system to keep our profile loaded, in order to make
  				// sure that we keep the default profile enabled we dynamically
  				// reload it if necessary.
  				if err := ensureDefaultAppArmorProfile(); err != nil {
  					return err
  				}
  			}
  			s.Process.ApparmorProfile = appArmorProfile
  		}
  		return nil
  	}
  }
docs: // WithApparmor sets the apparmor profile