When restart: always isn't enough: making Compose stacks recover at boot

Restart policies only cover containers that have already started. When AppArmor blocked dockerd's default profile at boot, thirteen containers stayed down for four hours. Here's my fix.