One thing I noticed with Ubuntu running an nginx reverse proxy, is that it’ll spin up multiple processes if you are proxying more than one Web service and (I think I’ve diagnosed this correctly) due to this app armour profiling breaks.

I think at this point, containerizing nginx with either lxd or docker using apparmor is the next best move. I know SElinux takes things further, but just thought I’d highlight a simple work around. I know people opinion on snaps, but they also use apparmor.