diff --git a/install-stack.sh b/install-stack.sh
index 6c659c5..c8caf4e 100755
--- a/install-stack.sh
+++ b/install-stack.sh
@@ -389,6 +389,14 @@ install_docker() {
   local id=$1
   pct exec "$id" -- bash -s &>/dev/null <<'DOCKER_INSTALL'
 export DEBIAN_FRONTEND=noninteractive
+# Docker-in-LXC: neutralise AppArmor so Docker never tries to load a profile.
+# In a confined LXC that fails ("docker-default ... while confined") for BOTH
+# image builds and container runtime. Removing apparmor_parser makes Docker
+# run everything unconfined — the container itself is the isolation boundary.
+if [ -e /usr/sbin/apparmor_parser ]; then
+  mv -f /usr/sbin/apparmor_parser /usr/sbin/apparmor_parser.disabled
+  systemctl is-active --quiet docker && systemctl restart docker
+fi
 # Idempotent: if Docker's already here, just make sure it's running and bail.
 if command -v docker >/dev/null 2>&1; then
   systemctl enable --now docker ssh 2>/dev/null