hotel-manage-stack/stack-init
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

install_docker: disable apparmor_parser (fixes build+runtime in confined LXC)

Browse source
This commit is contained in:
jtricerolph 2026-07-01 13:46:11 +00:00
parent 2469b94b1f
commit 9a45e39db6
1 changed files with 8 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

8
install-stack.sh
View file

@ -389,6 +389,14 @@ install_docker() {
local id=$1 local id=$1
pct exec "$id" -- bash -s &>/dev/null <<'DOCKER_INSTALL' pct exec "$id" -- bash -s &>/dev/null <<'DOCKER_INSTALL'
export DEBIAN_FRONTEND=noninteractive export DEBIAN_FRONTEND=noninteractive
# Docker-in-LXC: neutralise AppArmor so Docker never tries to load a profile.
# In a confined LXC that fails ("docker-default ... while confined") for BOTH
# image builds and container runtime. Removing apparmor_parser makes Docker
# run everything unconfined — the container itself is the isolation boundary.
if [ -e /usr/sbin/apparmor_parser ]; then
mv -f /usr/sbin/apparmor_parser /usr/sbin/apparmor_parser.disabled
systemctl is-active --quiet docker && systemctl restart docker
fi
# Idempotent: if Docker's already here, just make sure it's running and bail. # Idempotent: if Docker's already here, just make sure it's running and bail.
if command -v docker >/dev/null 2>&1; then if command -v docker >/dev/null 2>&1; then
systemctl enable --now docker ssh 2>/dev/null systemctl enable --now docker ssh 2>/dev/null