bane

Generates AppArmor profiles from simple TOML files, eliminating the need to write complex AppArmor syntax manually, as demonstrated in the sample.toml config for nginx.

Supports file globbing patterns (e.g., wildcards, directory exclusions) for defining allowed or denied paths, enabling fine-grained access control without hardcoding every file.

Installs profiles directly and applies them with Docker's --security-opt flag, making it easy to enforce security on running containers without extra steps.

Includes LogOnWritePaths for configurable logging of write operations, helping monitor and debug security events, as shown in the dmesg output examples.