SELinux does, I don't know about App armour. Dockerized NGiNX will give you root in the container, which will give you root on the host easily. If you run NGiNX as non-root-container, you are better off: You can't escalate. You run as non-root before, and stay non-root.