From 2a9f66b4bf2c2ba5d5cc7d590c5b4aa9ed8427e3 Mon Sep 17 00:00:00 2001 From: jtricerolph Date: Fri, 24 Jul 2026 18:04:32 +0000 Subject: [PATCH 1/2] add-app.sh: disable apparmor_parser in new app LXCs, matching install-stack.sh MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit add-app.sh had a separate Docker-install block that never got the AppArmor fix from install-stack.sh's install_docker() (commit 9a45e39) — every app added individually via add-app.sh since then was exposed to Docker builds failing with "docker-default profile could not be loaded ... while confined". Hit this deploying the calendar app to LXC 126 on the dev stack. Co-Authored-By: Claude Sonnet 5 --- add-app.sh | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/add-app.sh b/add-app.sh index d4f4440..28c7d9d 100755 --- a/add-app.sh +++ b/add-app.sh @@ -143,6 +143,16 @@ curl -fsSL https://download.docker.com/linux/ubuntu/gpg | gpg --dearmor -o /etc/ echo "deb [arch=amd64 signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/ubuntu jammy stable" \ > /etc/apt/sources.list.d/docker.list apt-get update -qq && apt-get install -y -qq docker-ce docker-ce-cli containerd.io docker-compose-plugin +# Docker-in-LXC: neutralise AppArmor so Docker never tries to load a profile. +# In a confined LXC that fails ("docker-default ... while confined") for BOTH +# image builds and container runtime. Removing apparmor_parser makes Docker +# run everything unconfined — the container itself is the isolation boundary. +# (Same fix as install-stack.sh's install_docker() — see stack-init commit +# 9a45e39. Do NOT set lxc.apparmor.profile: unconfined on the LXC instead — +# that cancels the nesting=1 feature.) +if [ -e /usr/sbin/apparmor_parser ]; then + mv -f /usr/sbin/apparmor_parser /usr/sbin/apparmor_parser.disabled +fi systemctl enable --now docker ssh DOCKER msg_ok "Docker installed" From ea5abf7bae49b1e268dec5c9e00ebf11e0d62169 Mon Sep 17 00:00:00 2001 From: jtricerolph Date: Sat, 25 Jul 2026 21:45:05 +0000 Subject: [PATCH 2/2] Keep fresh-install maintenance seed category in sync with Open group --- install-stack.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/install-stack.sh b/install-stack.sh index e950d2a..e6a8f31 100755 --- a/install-stack.sh +++ b/install-stack.sh @@ -1214,7 +1214,7 @@ ${build_out}" msg_info "Seeding maintenance into auth DB" pct exec 100 -- docker exec hotel-manage-postgres psql -U postgres -d auth_db -c " INSERT INTO apps (slug, name, description, base_path, icon, theme_color, category, internal_host, internal_port) - VALUES ('maintenance', 'Maintenance', 'Maintenance log book — faults, recurring tasks, assets and contractors', '/maintenance', 'Wrench', '#b45309', 'Operations', '10.10.10.121', 3080) + VALUES ('maintenance', 'Maintenance', 'Maintenance log book — faults, recurring tasks, assets and contractors', '/maintenance', 'Wrench', '#b45309', 'Open', '10.10.10.121', 3080) ON CONFLICT (slug) DO UPDATE SET name=EXCLUDED.name, description=EXCLUDED.description, base_path=EXCLUDED.base_path, icon=EXCLUDED.icon, theme_color=EXCLUDED.theme_color, category=EXCLUDED.category,