Docker-in-LXC: run containers AppArmor-unconfined (idempotent, fixes existing LXCs)

add-app.sh

@@ -124,8 +124,11 @@ pct create "$LXC_ID" "$TEMPLATE" \
   --unprivileged 0 \
   --onboot 1 \
   --tags "${POOL}" \
-  ${POOL_OPT} \
+  ${POOL_OPT} &>/dev/null
-  --start 1 &>/dev/null
+# Docker-in-LXC: run AppArmor-unconfined so containers can start
+grep -q '^lxc.apparmor.profile: unconfined' "/etc/pve/lxc/${LXC_ID}.conf" 2>/dev/null \
+  || echo "lxc.apparmor.profile: unconfined" >> "/etc/pve/lxc/${LXC_ID}.conf"
+pct start "$LXC_ID" &>/dev/null
 sleep 5
 msg_ok "LXC ${LXC_ID} created"
 

install-stack.sh

@@ -335,51 +335,68 @@ ensure_pool() {
   pvesh get "/pools/${POOL}" &>/dev/null && POOL_OPT="--pool ${POOL}"
 }
 
+# Docker-in-LXC needs the container to run AppArmor-unconfined, otherwise
+# containers fail with "docker-default profile could not be loaded ... while
+# confined". Idempotent: adds the line if missing, (re)starts only when needed.
+apply_docker_lxc_conf() {
+  local id=$1 created=$2
+  local conf="/etc/pve/lxc/${id}.conf" changed=0
+  if ! grep -q '^lxc.apparmor.profile: unconfined' "$conf" 2>/dev/null; then
+    echo "lxc.apparmor.profile: unconfined" >> "$conf"
+    changed=1
+  fi
+  if [[ "$created" == 1 ]]; then
+    pct start "$id" &>/dev/null; sleep 5
+  elif [[ "$changed" == 1 ]]; then
+    pct stop "$id" &>/dev/null || true; pct start "$id" &>/dev/null; sleep 5
+  elif ! lxc_running "$id"; then
+    pct start "$id" &>/dev/null; sleep 5
+  fi
+}
+
 create_lxc() {
-  local id=$1 ip=$2 name=$3 mem=${4:-512} cores=${5:-1}
+  local id=$1 ip=$2 name=$3 mem=${4:-512} cores=${5:-1} created=0
   if lxc_exists "$id"; then
     msg_warn "LXC $id (hotel-manage-${name}) already exists — skipping creation"
-    lxc_running "$id" || pct start "$id"
+  else
-    return
+    local tmpl; tmpl=$(get_template)
+    pct create "$id" "$tmpl" \
+      --hostname "hotel-manage-${name}" \
+      --memory "$mem" \
+      --cores "$cores" \
+      --rootfs "${STORAGE}:8" \
+      --net0 "name=eth0,bridge=vmbr1,ip=${ip}/24,gw=10.10.10.1" \
+      --features nesting=1 \
+      --unprivileged 0 \
+      --onboot 1 \
+      --tags "${POOL}" \
+      ${POOL_OPT} &>/dev/null
+    created=1
   fi
-  local tmpl; tmpl=$(get_template)
+  apply_docker_lxc_conf "$id" "$created"
-  pct create "$id" "$tmpl" \
-    --hostname "hotel-manage-${name}" \
-    --memory "$mem" \
-    --cores "$cores" \
-    --rootfs "${STORAGE}:8" \
-    --net0 "name=eth0,bridge=vmbr1,ip=${ip}/24,gw=10.10.10.1" \
-    --features nesting=1 \
-    --unprivileged 0 \
-    --onboot 1 \
-    --tags "${POOL}" \
-    ${POOL_OPT} \
-    --start 1 &>/dev/null
-  sleep 5  # let systemd start
 }
 
 create_npm_lxc() {
-  local id=103
+  local id=103 created=0
   if lxc_exists "$id"; then
     msg_warn "LXC $id (hotel-manage-npm) already exists — skipping creation"
-    lxc_running "$id" || pct start "$id"
+  else
-    return
+    local tmpl; tmpl=$(get_template)
+    pct create "$id" "$tmpl" \
+      --hostname "hotel-manage-npm" \
+      --memory 512 \
+      --cores 1 \
+      --rootfs "${STORAGE}:8" \
+      --net0 "name=eth0,bridge=vmbr0,ip=${NPM_LAN_IP}/22,gw=${LAN_GW}" \
+      --net1 "name=eth1,bridge=vmbr1,ip=10.10.10.3/24" \
+      --features nesting=1 \
+      --unprivileged 0 \
+      --onboot 1 \
+      --tags "${POOL}" \
+      ${POOL_OPT} &>/dev/null
+    created=1
   fi
-  local tmpl; tmpl=$(get_template)
+  apply_docker_lxc_conf "$id" "$created"
-  pct create "$id" "$tmpl" \
-    --hostname "hotel-manage-npm" \
-    --memory 512 \
-    --cores 1 \
-    --rootfs "${STORAGE}:8" \
-    --net0 "name=eth0,bridge=vmbr0,ip=${NPM_LAN_IP}/22,gw=${LAN_GW}" \
-    --net1 "name=eth1,bridge=vmbr1,ip=10.10.10.3/24" \
-    --features nesting=1 \
-    --unprivileged 0 \
-    --onboot 1 \
-    --tags "${POOL}" \
-    ${POOL_OPT} \
-    --start 1 &>/dev/null
-  sleep 5
 }
 
 install_docker() {