From 69db7d5426084a9d90b2a7c3543383f4ed419779 Mon Sep 17 00:00:00 2001
From: jtricerolph <info@tricerolph.com>
Date: Wed, 1 Jul 2026 13:17:20 +0000
Subject: [PATCH] Docker-in-LXC: run containers AppArmor-unconfined
 (idempotent, fixes existing LXCs)

---
 add-app.sh       |  7 ++--
 install-stack.sh | 87 +++++++++++++++++++++++++++++-------------------
 2 files changed, 57 insertions(+), 37 deletions(-)

diff --git a/add-app.sh b/add-app.sh
index f8595b9..86ac49a 100755
--- a/add-app.sh
+++ b/add-app.sh
@@ -124,8 +124,11 @@ pct create "$LXC_ID" "$TEMPLATE" \
   --unprivileged 0 \
   --onboot 1 \
   --tags "${POOL}" \
-  ${POOL_OPT} \
-  --start 1 &>/dev/null
+  ${POOL_OPT} &>/dev/null
+# Docker-in-LXC: run AppArmor-unconfined so containers can start
+grep -q '^lxc.apparmor.profile: unconfined' "/etc/pve/lxc/${LXC_ID}.conf" 2>/dev/null \
+  || echo "lxc.apparmor.profile: unconfined" >> "/etc/pve/lxc/${LXC_ID}.conf"
+pct start "$LXC_ID" &>/dev/null
 sleep 5
 msg_ok "LXC ${LXC_ID} created"
 
diff --git a/install-stack.sh b/install-stack.sh
index 0970614..fea2933 100755
--- a/install-stack.sh
+++ b/install-stack.sh
@@ -335,51 +335,68 @@ ensure_pool() {
   pvesh get "/pools/${POOL}" &>/dev/null && POOL_OPT="--pool ${POOL}"
 }
 
+# Docker-in-LXC needs the container to run AppArmor-unconfined, otherwise
+# containers fail with "docker-default profile could not be loaded ... while
+# confined". Idempotent: adds the line if missing, (re)starts only when needed.
+apply_docker_lxc_conf() {
+  local id=$1 created=$2
+  local conf="/etc/pve/lxc/${id}.conf" changed=0
+  if ! grep -q '^lxc.apparmor.profile: unconfined' "$conf" 2>/dev/null; then
+    echo "lxc.apparmor.profile: unconfined" >> "$conf"
+    changed=1
+  fi
+  if [[ "$created" == 1 ]]; then
+    pct start "$id" &>/dev/null; sleep 5
+  elif [[ "$changed" == 1 ]]; then
+    pct stop "$id" &>/dev/null || true; pct start "$id" &>/dev/null; sleep 5
+  elif ! lxc_running "$id"; then
+    pct start "$id" &>/dev/null; sleep 5
+  fi
+}
+
 create_lxc() {
-  local id=$1 ip=$2 name=$3 mem=${4:-512} cores=${5:-1}
+  local id=$1 ip=$2 name=$3 mem=${4:-512} cores=${5:-1} created=0
   if lxc_exists "$id"; then
     msg_warn "LXC $id (hotel-manage-${name}) already exists — skipping creation"
-    lxc_running "$id" || pct start "$id"
-    return
+  else
+    local tmpl; tmpl=$(get_template)
+    pct create "$id" "$tmpl" \
+      --hostname "hotel-manage-${name}" \
+      --memory "$mem" \
+      --cores "$cores" \
+      --rootfs "${STORAGE}:8" \
+      --net0 "name=eth0,bridge=vmbr1,ip=${ip}/24,gw=10.10.10.1" \
+      --features nesting=1 \
+      --unprivileged 0 \
+      --onboot 1 \
+      --tags "${POOL}" \
+      ${POOL_OPT} &>/dev/null
+    created=1
   fi
-  local tmpl; tmpl=$(get_template)
-  pct create "$id" "$tmpl" \
-    --hostname "hotel-manage-${name}" \
-    --memory "$mem" \
-    --cores "$cores" \
-    --rootfs "${STORAGE}:8" \
-    --net0 "name=eth0,bridge=vmbr1,ip=${ip}/24,gw=10.10.10.1" \
-    --features nesting=1 \
-    --unprivileged 0 \
-    --onboot 1 \
-    --tags "${POOL}" \
-    ${POOL_OPT} \
-    --start 1 &>/dev/null
-  sleep 5  # let systemd start
+  apply_docker_lxc_conf "$id" "$created"
 }
 
 create_npm_lxc() {
-  local id=103
+  local id=103 created=0
   if lxc_exists "$id"; then
     msg_warn "LXC $id (hotel-manage-npm) already exists — skipping creation"
-    lxc_running "$id" || pct start "$id"
-    return
+  else
+    local tmpl; tmpl=$(get_template)
+    pct create "$id" "$tmpl" \
+      --hostname "hotel-manage-npm" \
+      --memory 512 \
+      --cores 1 \
+      --rootfs "${STORAGE}:8" \
+      --net0 "name=eth0,bridge=vmbr0,ip=${NPM_LAN_IP}/22,gw=${LAN_GW}" \
+      --net1 "name=eth1,bridge=vmbr1,ip=10.10.10.3/24" \
+      --features nesting=1 \
+      --unprivileged 0 \
+      --onboot 1 \
+      --tags "${POOL}" \
+      ${POOL_OPT} &>/dev/null
+    created=1
   fi
-  local tmpl; tmpl=$(get_template)
-  pct create "$id" "$tmpl" \
-    --hostname "hotel-manage-npm" \
-    --memory 512 \
-    --cores 1 \
-    --rootfs "${STORAGE}:8" \
-    --net0 "name=eth0,bridge=vmbr0,ip=${NPM_LAN_IP}/22,gw=${LAN_GW}" \
-    --net1 "name=eth1,bridge=vmbr1,ip=10.10.10.3/24" \
-    --features nesting=1 \
-    --unprivileged 0 \
-    --onboot 1 \
-    --tags "${POOL}" \
-    ${POOL_OPT} \
-    --start 1 &>/dev/null
-  sleep 5
+  apply_docker_lxc_conf "$id" "$created"
 }
 
 install_docker() {