Docker-in-LXC: security_opt in composes; revert LXC apparmor override; doc

add-app.sh

@@ -124,11 +124,8 @@ pct create "$LXC_ID" "$TEMPLATE" \
   --unprivileged 0 \
   --onboot 1 \
   --tags "${POOL}" \
-  ${POOL_OPT} &>/dev/null
+  ${POOL_OPT} \
-# Docker-in-LXC: run AppArmor-unconfined so containers can start
+  --start 1 &>/dev/null
-grep -q '^lxc.apparmor.profile: unconfined' "/etc/pve/lxc/${LXC_ID}.conf" 2>/dev/null \
-  || echo "lxc.apparmor.profile: unconfined" >> "/etc/pve/lxc/${LXC_ID}.conf"
-pct start "$LXC_ID" &>/dev/null
 sleep 5
 msg_ok "LXC ${LXC_ID} created"
 

docs/APP-INTEGRATION-GUIDE.md

@@ -292,10 +292,18 @@ location /kitchen/health {
 
 ### 6. Docker Compose Template
 
+> **Docker-in-LXC:** every service needs `security_opt: [apparmor=unconfined]`.
+> The app LXCs run with `nesting=1` but are AppArmor-confined, so without this a
+> container fails to start with *"docker-default profile could not be loaded …
+> while confined"*. Do NOT set `lxc.apparmor.profile: unconfined` on the LXC —
+> that cancels `nesting=1`.
+
 ```yaml
 services:
   backend:
     build: ./backend
+    security_opt:
+      - apparmor=unconfined
     environment:
       - DATABASE_URL=postgresql://appname:${DB_PASS}@10.10.10.100:5432/appname_db
       - CENTRAL_AUTH_SECRET=${CENTRAL_AUTH_SECRET}
@@ -310,6 +318,8 @@ services:
 
   frontend:
     build: ./frontend
+    security_opt:
+      - apparmor=unconfined
     ports:
       - "3080:80"    # this port is what NPM proxies to
     depends_on:

install-stack.sh

@@ -335,30 +335,16 @@ ensure_pool() {
   pvesh get "/pools/${POOL}" &>/dev/null && POOL_OPT="--pool ${POOL}"
 }
 
-# Docker-in-LXC needs the container to run AppArmor-unconfined, otherwise
+# Docker-in-LXC: keep the nesting=1 feature (needed by Docker) and let each
-# containers fail with "docker-default profile could not be loaded ... while
+# container skip AppArmor via `security_opt: apparmor=unconfined` in its compose.
-# confined". Idempotent: adds the line if missing, (re)starts only when needed.
+# (Overriding lxc.apparmor.profile would cancel nesting — don't do that.)
-apply_docker_lxc_conf() {
-  local id=$1 created=$2
-  local conf="/etc/pve/lxc/${id}.conf" changed=0
-  if ! grep -q '^lxc.apparmor.profile: unconfined' "$conf" 2>/dev/null; then
-    echo "lxc.apparmor.profile: unconfined" >> "$conf"
-    changed=1
-  fi
-  if [[ "$created" == 1 ]]; then
-    pct start "$id" &>/dev/null; sleep 5
-  elif [[ "$changed" == 1 ]]; then
-    pct stop "$id" &>/dev/null || true; pct start "$id" &>/dev/null; sleep 5
-  elif ! lxc_running "$id"; then
-    pct start "$id" &>/dev/null; sleep 5
-  fi
-}
-
 create_lxc() {
-  local id=$1 ip=$2 name=$3 mem=${4:-512} cores=${5:-1} created=0
+  local id=$1 ip=$2 name=$3 mem=${4:-512} cores=${5:-1}
   if lxc_exists "$id"; then
     msg_warn "LXC $id (hotel-manage-${name}) already exists — skipping creation"
-  else
+    lxc_running "$id" || pct start "$id"
+    return
+  fi
   local tmpl; tmpl=$(get_template)
   pct create "$id" "$tmpl" \
     --hostname "hotel-manage-${name}" \
@@ -370,17 +356,18 @@ create_lxc() {
     --unprivileged 0 \
     --onboot 1 \
     --tags "${POOL}" \
-      ${POOL_OPT} &>/dev/null
+    ${POOL_OPT} \
-    created=1
+    --start 1 &>/dev/null
-  fi
+  sleep 5
-  apply_docker_lxc_conf "$id" "$created"
 }
 
 create_npm_lxc() {
-  local id=103 created=0
+  local id=103
   if lxc_exists "$id"; then
     msg_warn "LXC $id (hotel-manage-npm) already exists — skipping creation"
-  else
+    lxc_running "$id" || pct start "$id"
+    return
+  fi
   local tmpl; tmpl=$(get_template)
   pct create "$id" "$tmpl" \
     --hostname "hotel-manage-npm" \
@@ -393,10 +380,9 @@ create_npm_lxc() {
     --unprivileged 0 \
     --onboot 1 \
     --tags "${POOL}" \
-      ${POOL_OPT} &>/dev/null
+    ${POOL_OPT} \
-    created=1
+    --start 1 &>/dev/null
-  fi
+  sleep 5
-  apply_docker_lxc_conf "$id" "$created"
 }
 
 install_docker() {
@@ -521,6 +507,8 @@ services:
   postgres:
     container_name: hotel-manage-postgres
     image: postgres:16-alpine
+    security_opt:
+      - apparmor=unconfined
     environment:
       - POSTGRES_USER=postgres
       - POSTGRES_PASSWORD=${PG_SUPERPASS}
@@ -662,6 +650,8 @@ services:
   npm:
     container_name: hotel-manage-npm
     image: jc21/nginx-proxy-manager:latest
+    security_opt:
+      - apparmor=unconfined
     ports:
       - "80:80"
       - "443:443"