dockerd: Document new options

docs/reference/dockerd.md

@@ -25,6 +25,7 @@ A self-sufficient runtime for containers.
 Options:
       --add-runtime runtime                   Register an additional OCI compatible runtime (default [])
       --allow-direct-routing                  Allow remote access to published ports on container IP addresses
+      --apparmor-profile string               Path to AppArmor profile template
       --authorization-plugin list             Authorization plugins to load
       --bip string                            IPv4 address for the default bridge
       --bip6 string                           IPv6 address for the default bridge
@@ -51,6 +52,7 @@ Options:
       --default-network-opt mapmap            Default network options (default map[])
       --default-runtime string                Default OCI runtime for containers (default "runc")
       --default-shm-size bytes                Default shm size for containers (default 64MiB)
+      --default-stop-timeout int              Set the default container stop timeout in seconds (0 to terminate immediately) (default 10)
       --default-ulimit ulimit                 Default ulimits for containers (default [])
       --dns list                              DNS server to use
       --dns-opt list                          DNS options to use
@@ -758,6 +760,18 @@ This only adds the proxy and authentication to the Docker daemon's requests.
 To use the proxy when building images and running containers, see
 [Configure Docker to use a proxy server](https://docs.docker.com/engine/cli/proxy/)
 
+### Default container stop timeout
+
+The `--default-stop-timeout` flag sets the number of seconds to wait for a
+container to stop when the container doesn't have a `--stop-timeout` configured.
+The default is `10` seconds on Linux and `30` seconds on Windows. A value of `0`
+doesn't wait before forcefully terminating the container. Negative values are
+invalid.
+
+You can also configure the timeout with the `default-stop-timeout` option in the
+[daemon configuration file](#daemon-configuration-file). You can reload this
+option without restarting the daemon.
+
 ### Default `ulimit` settings
 
 The `--default-ulimit` flag lets you set the default `ulimit` options to use for
@@ -793,6 +807,24 @@ allow the request for it to complete.
 For information about how to create an authorization plugin, refer to the
 [authorization plugin](https://docs.docker.com/engine/extend/plugins_authorization/) section.
 
+### Configure the default AppArmor profile
+
+The `--apparmor-profile` option sets the path to an AppArmor profile definition
+for Docker's default `docker-default` container profile. This option is only
+supported on Linux hosts. The file can be a static profile or a Go template.
+
+The equivalent `daemon.json` configuration is:
+
+```json
+{
+  "apparmor-profile": "/etc/docker/apparmor/docker-default"
+}
+```
+
+Restart the daemon to apply changes. For template values, safe file placement,
+security considerations, and verification, see
+[Customize the default AppArmor profile](https://docs.docker.com/engine/security/apparmor/#customize-the-default-profile).
+
 ### Daemon user namespace options
 
 The Linux kernel
@@ -1066,6 +1098,7 @@ The following is a full example of the allowed configuration options on Linux:
 ```json
 {
   "allow-direct-routing": false,
+  "apparmor-profile": "",
   "authorization-plugins": [],
   "bip": "",
   "bip6": "",
@@ -1104,6 +1137,7 @@ The following is a full example of the allowed configuration options on Linux:
   "default-network-opts": {},
   "default-runtime": "runc",
   "default-shm-size": "64M",
+  "default-stop-timeout": 10,
   "default-ulimits": {
     "nofile": {
       "Hard": 64000,
@@ -1225,6 +1259,7 @@ The following is a full example of the allowed configuration options on Windows:
   "debug": true,
   "default-network-opts": {},
   "default-runtime": "",
+  "default-stop-timeout": 30,
   "default-ulimits": {},
   "dns": [],
   "dns-opts": [],
@@ -1317,6 +1352,7 @@ The list of currently supported options that can be reconfigured is this:
 | `max-concurrent-uploads`           | Configures the max concurrent uploads for each push.                                                        |
 | `max-download-attempts`            | Configures the max download attempts for each pull.                                                         |
 | `default-runtime`                  | Configures the runtime to be used if not is specified at container creation.                                |
+| `default-stop-timeout`             | Configures the timeout for stopping containers that have no container-specific timeout.                     |
 | `runtimes`                         | Configures the list of available OCI runtimes that can be used to run containers.                           |
 | `authorization-plugin`             | Specifies the authorization plugins to use.                                                                 |
 | `insecure-registries`              | Specifies a list of registries that the daemon should consider insecure.                                    |