For normal containers docker will put the container in the docker-default profile. For privileged containers, no profile is applied and the process is unconfined. Since the container is unconfined, the child processes are subject to getting a profile from the host auto applied base on the binaries path.

To see this happen, on ubuntu, install tcpdump and apparmor on the host. Then install tcpdump in a privileged container. tcpdump in the privileged container will not run.

It seems the correct fix would be to create a "docker-unconfined" profile that is applied to privileged containers. The profile would not actually restrict anything, but allow all. The only purpose of using this profile is to prevent the host from auto applying profiles to container processes.