docs: Add AppArmor profile to task runner hardening guide

[tomi]

Summary

• Adds a new section to the task runner hardening guide on configuring an AppArmor profile
• The profile blocks reads to sensitive /proc files (environ, mounts) that could leak secrets to code running inside the container
• Framed as a defence-in-depth measure, with links to both AppArmor and the Kubernetes AppArmor docs

Test plan

• Verify the page renders correctly in the docs site
• Confirm external links resolve

---

Summary by cubic

Add an AppArmor section to the task runner hardening guide to block access to sensitive /proc files and reduce secrets exposure. Includes an example rule (audit deny @{PROC}/[0-9]*/{environ,mounts} rwl,) and links to AppArmor and Kubernetes docs.

^{Written for commit 30818fc. Summary will update on new commits. Review in cubic}

[netlify]

✅ Deploy Preview for n8n-docs ready!

Name	Link
🔨 Latest commit	30818fc
🔍 Latest deploy log	https://app.netlify.com/projects/n8n-docs/deploys/6a0ede017423500008bc53f7
😎 Deploy Preview	https://deploy-preview-4682--n8n-docs.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[github-actions]

No description provided.

[cubic-dev-ai]

No issues found across 1 file

Architecture diagram

sequenceDiagram
    participant Runner as Task Runner Container
    participant Kernel as AppArmor LSM
    participant ProcFS as /proc Filesystem
    participant Audit as Audit Log

    Note over Runner,Audit: AppArmor Profile Enforcement Flow

    Runner->>Kernel: Request read /proc/[pid]/environ
    Kernel->>Kernel: Check AppArmor profile rules
    alt Deny rule matches
        Kernel->>Audit: Log denied operation
        Kernel-->>Runner: Permission denied
    else No matching rule
        Kernel->>ProcFS: Allow read
        ProcFS-->>Runner: Environment variables (secrets)
    end

    Runner->>Kernel: Request read /proc/[pid]/mounts
    Kernel->>Kernel: Check AppArmor profile rules
    alt Deny rule matches
        Kernel->>Audit: Log denied operation
        Kernel-->>Runner: Permission denied
    else No matching rule
        Kernel->>ProcFS: Allow read
        ProcFS-->>Runner: Mount info
    end

    Note over Runner,Kernel: Defence-in-depth: blocks secret leakage via /proc access at kernel level, before any container or language-level protection

Loading

_{Re-trigger cubic}

[cloudflare-workers-and-pages]

Deploying n8n-docs with    Cloudflare Pages

Latest commit:	30818fc
Status:	✅  Deploy successful!
Preview URL:	https://c9160530.n8n-docs-d9c.pages.dev
Branch Preview URL:	https://tomi-task-runner-apparmor-pr.n8n-docs-d9c.pages.dev

View logs