fix(docker): add apparmor:unconfined security_opt for PVE LXC compatibility - #91
Merged
Conversation
Owner
|
感谢 |
hanxi
added a commit
that referenced
this pull request
Jul 28, 2026
合并单容器时 AGENTS.md 一行未改，处处与代码矛盾：项目结构树还画着已删除的 cups/ 目录、写着 debian:bookworm-slim + nonroot 用户 + 三个构建阶段、缺全部 /api/admin/drivers/* 接口。 AGENTS.md： - 按 git ls-files 重画结构树；修正 trixie-slim / root 运行 / 五个构建阶段 / Java 21 / CI 单 job - 补齐 7 个驱动接口与异步任务模型，写明为什么必须异步（WriteTimeout 会 kill 掉正在 make 的进程），防止后人「简化」回同步 - 新增「驱动管理」章节：持久化原理、manifest 白名单为什么必须存在、单一 EXIT trap 约定、退出码约定、架构探测约定、.ppd 与 .deb 的不对称、.deb 上传的 root RCE 风险面、lpinfo 解析的格式假设 - 新增「容器启动流程」章节：10 步启动顺序、watchdog 的 wait 子进程语义陷阱、 restore-drivers 必须永远 exit 0 的原因 - ca-certificates 标注「请勿删除」并记下 exit 5 的根因 - 核对 cidfmapPreambleArgs 仍存在且仍被调用，改为如实描述两种加载机制并存 - 新增「新增支持的打印机驱动」开发任务指引 - 记下遗留待办：print/convert/estimate/compose 四个 handler 同样把 ParseMultipartForm 的 maxMemory 当成请求体上限，本次未一并收敛 README：驱动安装异步、单任务限制、架构禁用、.deb 重启需重装、.drivers 卷丢失 即丢驱动；.deb 上传等同容器内 root 执行任意代码的风险提示；二进制部署下驱动 管理不可用的能力边界；环境变量/端口/卷与 compose 逐项对齐。 docker-compose.yml：补回被删的解释性注释——为什么 USB 必须 bind-mount 整个 /dev/bus/usb 而不能用 devices:（issue #81，后开机的打印机节点不会传播进容器）、 apparmor:unconfined 的用途（issue #91），以及 .drivers 卷的作用与删除后果。 配置项还在但注释没了，后人很容易「清理」掉再踩一遍。 .gitignore 补 .drivers（.dockerignore 已有，漏了这边）。
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
从 PVE 7.0 及以上版本（如 PVE 7.x / 8.x，基于 Linux 内核 5.11+ / 6.x）开始，PVE 在 LXC 嵌套 Docker 环境下启用了更严格的 AppArmor 限制。系统的 Docker 默认 AppArmor 配置文件 (
docker-default) 会拦截容器内的 Unix Socket 创建与进程间通信，表现为 dmesg / audit 日志中出现类似apparmor="DENIED" operation="create" profile="docker-default" comm="jobs.cgi" family="unix"的报错，导致 CUPS 的jobs.cgi无法提交打印或 Web 端 LibreOffice / OFD 转换服务无法正常运行。#89