Following the documentation on https://github.com/opencontainers/runc the BUILDTAGS nokmem and apparmor are enabled by default since v1.0.0-rc9X. Also there just is a new version 1.1.10. Cheers, APN