From 9a45e39db67d15781dde5223c511eac076977894 Mon Sep 17 00:00:00 2001
From: jtricerolph <info@tricerolph.com>
Date: Wed, 1 Jul 2026 13:46:11 +0000
Subject: [PATCH] install_docker: disable apparmor_parser (fixes build+runtime
 in confined LXC)

---
 install-stack.sh | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/install-stack.sh b/install-stack.sh
index 6c659c5..c8caf4e 100755
--- a/install-stack.sh
+++ b/install-stack.sh
@@ -389,6 +389,14 @@ install_docker() {
   local id=$1
   pct exec "$id" -- bash -s &>/dev/null <<'DOCKER_INSTALL'
 export DEBIAN_FRONTEND=noninteractive
+# Docker-in-LXC: neutralise AppArmor so Docker never tries to load a profile.
+# In a confined LXC that fails ("docker-default ... while confined") for BOTH
+# image builds and container runtime. Removing apparmor_parser makes Docker
+# run everything unconfined — the container itself is the isolation boundary.
+if [ -e /usr/sbin/apparmor_parser ]; then
+  mv -f /usr/sbin/apparmor_parser /usr/sbin/apparmor_parser.disabled
+  systemctl is-active --quiet docker && systemctl restart docker
+fi
 # Idempotent: if Docker's already here, just make sure it's running and bail.
 if command -v docker >/dev/null 2>&1; then
   systemctl enable --now docker ssh 2>/dev/null