Docker-in-LXC: security_opt in composes; revert LXC apparmor override; doc

docs/APP-INTEGRATION-GUIDE.md

@@ -292,10 +292,18 @@ location /kitchen/health {
 
 ### 6. Docker Compose Template
 
+> **Docker-in-LXC:** every service needs `security_opt: [apparmor=unconfined]`.
+> The app LXCs run with `nesting=1` but are AppArmor-confined, so without this a
+> container fails to start with *"docker-default profile could not be loaded …
+> while confined"*. Do NOT set `lxc.apparmor.profile: unconfined` on the LXC —
+> that cancels `nesting=1`.
+
 ```yaml
 services:
   backend:
     build: ./backend
+    security_opt:
+      - apparmor=unconfined
     environment:
       - DATABASE_URL=postgresql://appname:${DB_PASS}@10.10.10.100:5432/appname_db
       - CENTRAL_AUTH_SECRET=${CENTRAL_AUTH_SECRET}
@@ -310,6 +318,8 @@ services:
 
   frontend:
     build: ./frontend
+    security_opt:
+      - apparmor=unconfined
     ports:
       - "3080:80"    # this port is what NPM proxies to
     depends_on: