hotel-manage-stack/stack-init
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

add-app.sh: disable apparmor_parser in new app LXCs, matching install-stack.sh

Browse source 
add-app.sh had a separate Docker-install block that never got the AppArmor
fix from install-stack.sh's install_docker() (commit 9a45e39) — every app
added individually via add-app.sh since then was exposed to Docker builds
failing with "docker-default profile could not be loaded ... while confined".
Hit this deploying the calendar app to LXC 126 on the dev stack.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This commit is contained in:
jtricerolph 2026-07-24 18:04:32 +00:00
parent 52e542d56c
commit 2a9f66b4bf
1 changed files with 10 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

10
add-app.sh
View file

@ -143,6 +143,16 @@ curl -fsSL https://download.docker.com/linux/ubuntu/gpg | gpg --dearmor -o /etc/
echo "deb [arch=amd64 signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/ubuntu jammy stable" \
> /etc/apt/sources.list.d/docker.list
apt-get update -qq && apt-get install -y -qq docker-ce docker-ce-cli containerd.io docker-compose-plugin
# Docker-in-LXC: neutralise AppArmor so Docker never tries to load a profile.
# In a confined LXC that fails ("docker-default ... while confined") for BOTH
# image builds and container runtime. Removing apparmor_parser makes Docker
# run everything unconfined — the container itself is the isolation boundary.
# (Same fix as install-stack.sh's install_docker() — see stack-init commit
# 9a45e39. Do NOT set lxc.apparmor.profile: unconfined on the LXC instead —
# that cancels the nesting=1 feature.)
if [ -e /usr/sbin/apparmor_parser ]; then
mv -f /usr/sbin/apparmor_parser /usr/sbin/apparmor_parser.disabled
fi
systemctl enable --now docker ssh
DOCKER
msg_ok "Docker installed"