There is Docker Bench for security that helps you get a quick overview for your system: https://github.com/docker/docker-bench-security

If you compare with LXD security on Docker is just sad...

Have fun hitting strange bugs: multi-stage builds break when you use user-namespaces: https://github.com/moby/moby/issues/34645

Using USER has some interesting side effects like no more access to /dev/stdout and /dev/stderr

Using apparmor profiles does not do what you think it would do (i.e. disallowing access outside of image-fs) it's rather a few rules to prevent access to certain /proc things.

But you can do this: https://docs.docker.com/engine/security/apparmor/