You can use all of them.
Each of these security features have different purposes, and there is actually little overlap. They all function to reduce the damage that a process can cause once it has been compromised. They are all very low-overhead and can be used to significantly improve the security of software.
Seccomp is a Linux feature that allows a userspace program to set up syscall filters. These filters specify which system calls are permitted, and what arguments they are permitted to have. It is a very low-level filter that reduces the attack surface area of the kernel. For example, a bug in
keyctl() that allows simple calls to that syscall to elevate privileges would not necessarily be usable for privesc in a program which has restricted access to that call. Writing a good seccomp policy is more involved than using Docker. You must modify the source code of the program to get the most out of seccomp, otherwise the most you can do is restrict the obviously unsafe syscalls.
AppArmor is a Mandatory Access Control framework that functions as an LSM (Linux Security Module). It is used to whitelist or blacklist a subject's (program's) access to an object (file, path, etc.). AppArmor may be used to allow a program to have read access to
/etc/passwd, but not
/etc/shadow. The policies can also be used to restrict capabilities, or even limit network access.
Capabilities and capability dropping is a general technique whereby a privileged process revokes a subset of the privileges it is endowed with. A root process can drop, for example, the capabilities required to create raw connections to the network, or the capabilities required to bypass standard UNIX file permissions (DAC), even though it remains root. This technique is not very fine-grained as there are only a limited number of capabilities that can be dropped, but it reduces the damage a program can do if it has been compromised nonetheless. Furthermore, some capabilities are root-equivalent in certain situations, meaning that they can be used to regain full root privileges.
In general, you should know that:
Seccomp reduces the chance that a kernel vulnerability will be successfully exploited.
AppArmor prevents an application from accessing files it should not access.
Capability dropping reduces the damage a compromised privileged process can do.
See also How is Sandboxing implemented? and Difference between linux capabities and seccomp