Ubuntu 26.04 containers with systemd 259 stuck initializing under Incus AppArmor profile; services hang in sd-mkuserns

[shehi]

Is there an existing issue for this?

• There is no existing issue for this bug

Is this happening on an up to date version of Incus?

• This is happening on a supported version of Incus

Incus system detailsAp

$ incus version
Client version: 6.23
Server version: 6.23

$ dpkg -l incus apparmor libapparmor1 | cat
Desired=Unknown/Install/Remove/Purge/Hold
| Status=Not/Inst/Conf-files/Unpacked/halF-conf/Half-inst/trig-aWait/Trig-pend
|/ Err?=(none)/Reinst-required (Status,Err: uppercase=bad)
||/ Name               Version                         Architecture Description
+++-==================-===============================-============-===========================================
ii  apparmor           5.0.0~alpha1-0ubuntu8.3         amd64        user-space parser utility for AppArmor
ii  incus              1:6.23-ubuntu24.04-202604230057 amd64        Incus - Container and virtualization daemon
ii  libapparmor1:amd64 5.0.0~alpha1-0ubuntu8.3         amd64        changehat AppArmor library

$ uname -a
Linux laptop-imanov 6.17.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Fri Mar 13 12:04:44 UTC 2026 x86_64 GNU/Linux

$ incus info
config: {}
api_extensions:
  - storage_zfs_remove_snapshots
  - container_host_shutdown_timeout
  - container_stop_priority
  - container_syscall_filtering
  - auth_pki
  - container_last_used_at
  - etag
  - patch
  - usb_devices
  - https_allowed_credentials
  - image_compression_algorithm
  - directory_manipulation
  - container_cpu_time
  - storage_zfs_use_refquota
  - storage_lvm_mount_options
  - network
  - profile_usedby
  - container_push
  - container_exec_recording
  - certificate_update
  - container_exec_signal_handling
  - gpu_devices
  - container_image_properties
  - migration_progress
  - id_map
  - network_firewall_filtering
  - network_routes
  - storage
  - file_delete
  - file_append
  - network_dhcp_expiry
  - storage_lvm_vg_rename
  - storage_lvm_thinpool_rename
  - network_vlan
  - image_create_aliases
  - container_stateless_copy
  - container_only_migration
  - storage_zfs_clone_copy
  - unix_device_rename
  - storage_lvm_use_thinpool
  - storage_rsync_bwlimit
  - network_vxlan_interface
  - storage_btrfs_mount_options
  - entity_description
  - image_force_refresh
  - storage_lvm_lv_resizing
  - id_map_base
  - file_symlinks
  - container_push_target
  - network_vlan_physical
  - storage_images_delete
  - container_edit_metadata
  - container_snapshot_stateful_migration
  - storage_driver_ceph
  - storage_ceph_user_name
  - resource_limits
  - storage_volatile_initial_source
  - storage_ceph_force_osd_reuse
  - storage_block_filesystem_btrfs
  - resources
  - kernel_limits
  - storage_api_volume_rename
  - network_sriov
  - console
  - restrict_dev_incus
  - migration_pre_copy
  - infiniband
  - dev_incus_events
  - proxy
  - network_dhcp_gateway
  - file_get_symlink
  - network_leases
  - unix_device_hotplug
  - storage_api_local_volume_handling
  - operation_description
  - clustering
  - event_lifecycle
  - storage_api_remote_volume_handling
  - nvidia_runtime
  - container_mount_propagation
  - container_backup
  - dev_incus_images
  - container_local_cross_pool_handling
  - proxy_unix
  - proxy_udp
  - clustering_join
  - proxy_tcp_udp_multi_port_handling
  - network_state
  - proxy_unix_dac_properties
  - container_protection_delete
  - unix_priv_drop
  - pprof_http
  - proxy_haproxy_protocol
  - network_hwaddr
  - proxy_nat
  - network_nat_order
  - container_full
  - backup_compression
  - nvidia_runtime_config
  - storage_api_volume_snapshots
  - storage_unmapped
  - projects
  - network_vxlan_ttl
  - container_incremental_copy
  - usb_optional_vendorid
  - snapshot_scheduling
  - snapshot_schedule_aliases
  - container_copy_project
  - clustering_server_address
  - clustering_image_replication
  - container_protection_shift
  - snapshot_expiry
  - container_backup_override_pool
  - snapshot_expiry_creation
  - network_leases_location
  - resources_cpu_socket
  - resources_gpu
  - resources_numa
  - kernel_features
  - id_map_current
  - event_location
  - storage_api_remote_volume_snapshots
  - network_nat_address
  - container_nic_routes
  - cluster_internal_copy
  - seccomp_notify
  - lxc_features
  - container_nic_ipvlan
  - network_vlan_sriov
  - storage_cephfs
  - container_nic_ipfilter
  - resources_v2
  - container_exec_user_group_cwd
  - container_syscall_intercept
  - container_disk_shift
  - storage_shifted
  - resources_infiniband
  - daemon_storage
  - instances
  - image_types
  - resources_disk_sata
  - clustering_roles
  - images_expiry
  - resources_network_firmware
  - backup_compression_algorithm
  - ceph_data_pool_name
  - container_syscall_intercept_mount
  - compression_squashfs
  - container_raw_mount
  - container_nic_routed
  - container_syscall_intercept_mount_fuse
  - container_disk_ceph
  - virtual-machines
  - image_profiles
  - clustering_architecture
  - resources_disk_id
  - storage_lvm_stripes
  - vm_boot_priority
  - unix_hotplug_devices
  - api_filtering
  - instance_nic_network
  - clustering_sizing
  - firewall_driver
  - projects_limits
  - container_syscall_intercept_hugetlbfs
  - limits_hugepages
  - container_nic_routed_gateway
  - projects_restrictions
  - custom_volume_snapshot_expiry
  - volume_snapshot_scheduling
  - trust_ca_certificates
  - snapshot_disk_usage
  - clustering_edit_roles
  - container_nic_routed_host_address
  - container_nic_ipvlan_gateway
  - resources_usb_pci
  - resources_cpu_threads_numa
  - resources_cpu_core_die
  - api_os
  - container_nic_routed_host_table
  - container_nic_ipvlan_host_table
  - container_nic_ipvlan_mode
  - resources_system
  - images_push_relay
  - network_dns_search
  - container_nic_routed_limits
  - instance_nic_bridged_vlan
  - network_state_bond_bridge
  - usedby_consistency
  - custom_block_volumes
  - clustering_failure_domains
  - resources_gpu_mdev
  - console_vga_type
  - projects_limits_disk
  - network_type_macvlan
  - network_type_sriov
  - container_syscall_intercept_bpf_devices
  - network_type_ovn
  - projects_networks
  - projects_networks_restricted_uplinks
  - custom_volume_backup
  - backup_override_name
  - storage_rsync_compression
  - network_type_physical
  - network_ovn_external_subnets
  - network_ovn_nat
  - network_ovn_external_routes_remove
  - tpm_device_type
  - storage_zfs_clone_copy_rebase
  - gpu_mdev
  - resources_pci_iommu
  - resources_network_usb
  - resources_disk_address
  - network_physical_ovn_ingress_mode
  - network_ovn_dhcp
  - network_physical_routes_anycast
  - projects_limits_instances
  - network_state_vlan
  - instance_nic_bridged_port_isolation
  - instance_bulk_state_change
  - network_gvrp
  - instance_pool_move
  - gpu_sriov
  - pci_device_type
  - storage_volume_state
  - network_acl
  - migration_stateful
  - disk_state_quota
  - storage_ceph_features
  - projects_compression
  - projects_images_remote_cache_expiry
  - certificate_project
  - network_ovn_acl
  - projects_images_auto_update
  - projects_restricted_cluster_target
  - images_default_architecture
  - network_ovn_acl_defaults
  - gpu_mig
  - project_usage
  - network_bridge_acl
  - warnings
  - projects_restricted_backups_and_snapshots
  - clustering_join_token
  - clustering_description
  - server_trusted_proxy
  - clustering_update_cert
  - storage_api_project
  - server_instance_driver_operational
  - server_supported_storage_drivers
  - event_lifecycle_requestor_address
  - resources_gpu_usb
  - clustering_evacuation
  - network_ovn_nat_address
  - network_bgp
  - network_forward
  - custom_volume_refresh
  - network_counters_errors_dropped
  - metrics
  - image_source_project
  - clustering_config
  - network_peer
  - linux_sysctl
  - network_dns
  - ovn_nic_acceleration
  - certificate_self_renewal
  - instance_project_move
  - storage_volume_project_move
  - cloud_init
  - network_dns_nat
  - database_leader
  - instance_all_projects
  - clustering_groups
  - ceph_rbd_du
  - instance_get_full
  - qemu_metrics
  - gpu_mig_uuid
  - event_project
  - clustering_evacuation_live
  - instance_allow_inconsistent_copy
  - network_state_ovn
  - storage_volume_api_filtering
  - image_restrictions
  - storage_zfs_export
  - network_dns_records
  - storage_zfs_reserve_space
  - network_acl_log
  - storage_zfs_blocksize
  - metrics_cpu_seconds
  - instance_snapshot_never
  - certificate_token
  - instance_nic_routed_neighbor_probe
  - event_hub
  - agent_nic_config
  - projects_restricted_intercept
  - metrics_authentication
  - images_target_project
  - images_all_projects
  - cluster_migration_inconsistent_copy
  - cluster_ovn_chassis
  - container_syscall_intercept_sched_setscheduler
  - storage_lvm_thinpool_metadata_size
  - storage_volume_state_total
  - instance_file_head
  - instances_nic_host_name
  - image_copy_profile
  - container_syscall_intercept_sysinfo
  - clustering_evacuation_mode
  - resources_pci_vpd
  - qemu_raw_conf
  - storage_cephfs_fscache
  - network_load_balancer
  - vsock_api
  - instance_ready_state
  - network_bgp_holdtime
  - storage_volumes_all_projects
  - metrics_memory_oom_total
  - storage_buckets
  - storage_buckets_create_credentials
  - metrics_cpu_effective_total
  - projects_networks_restricted_access
  - storage_buckets_local
  - loki
  - acme
  - internal_metrics
  - cluster_join_token_expiry
  - remote_token_expiry
  - init_preseed
  - storage_volumes_created_at
  - cpu_hotplug
  - projects_networks_zones
  - network_txqueuelen
  - cluster_member_state
  - instances_placement_scriptlet
  - storage_pool_source_wipe
  - zfs_block_mode
  - instance_generation_id
  - disk_io_cache
  - amd_sev
  - storage_pool_loop_resize
  - migration_vm_live
  - ovn_nic_nesting
  - oidc
  - network_ovn_l3only
  - ovn_nic_acceleration_vdpa
  - cluster_healing
  - instances_state_total
  - auth_user
  - security_csm
  - instances_rebuild
  - numa_cpu_placement
  - custom_volume_iso
  - network_allocations
  - zfs_delegate
  - storage_api_remote_volume_snapshot_copy
  - operations_get_query_all_projects
  - metadata_configuration
  - syslog_socket
  - event_lifecycle_name_and_project
  - instances_nic_limits_priority
  - disk_initial_volume_configuration
  - operation_wait
  - image_restriction_privileged
  - cluster_internal_custom_volume_copy
  - disk_io_bus
  - storage_cephfs_create_missing
  - instance_move_config
  - ovn_ssl_config
  - certificate_description
  - disk_io_bus_virtio_blk
  - loki_config_instance
  - instance_create_start
  - clustering_evacuation_stop_options
  - boot_host_shutdown_action
  - agent_config_drive
  - network_state_ovn_lr
  - image_template_permissions
  - storage_bucket_backup
  - storage_lvm_cluster
  - shared_custom_block_volumes
  - auth_tls_jwt
  - oidc_claim
  - device_usb_serial
  - numa_cpu_balanced
  - image_restriction_nesting
  - network_integrations
  - instance_memory_swap_bytes
  - network_bridge_external_create
  - network_zones_all_projects
  - storage_zfs_vdev
  - container_migration_stateful
  - profiles_all_projects
  - instances_scriptlet_get_instances
  - instances_scriptlet_get_cluster_members
  - instances_scriptlet_get_project
  - network_acl_stateless
  - instance_state_started_at
  - networks_all_projects
  - network_acls_all_projects
  - storage_buckets_all_projects
  - resources_load
  - instance_access
  - project_access
  - projects_force_delete
  - resources_cpu_flags
  - disk_io_bus_cache_filesystem
  - instance_oci
  - clustering_groups_config
  - instances_lxcfs_per_instance
  - clustering_groups_vm_cpu_definition
  - disk_volume_subpath
  - projects_limits_disk_pool
  - network_ovn_isolated
  - qemu_raw_qmp
  - network_load_balancer_health_check
  - oidc_scopes
  - network_integrations_peer_name
  - qemu_scriptlet
  - instance_auto_restart
  - storage_lvm_metadatasize
  - ovn_nic_promiscuous
  - ovn_nic_ip_address_none
  - instances_state_os_info
  - network_load_balancer_state
  - instance_nic_macvlan_mode
  - storage_lvm_cluster_create
  - network_ovn_external_interfaces
  - instances_scriptlet_get_instances_count
  - cluster_rebalance
  - custom_volume_refresh_exclude_older_snapshots
  - storage_initial_owner
  - storage_live_migration
  - instance_console_screenshot
  - image_import_alias
  - authorization_scriptlet
  - console_force
  - network_ovn_state_addresses
  - network_bridge_acl_devices
  - instance_debug_memory
  - init_preseed_storage_volumes
  - init_preseed_profile_project
  - instance_nic_routed_host_address
  - instance_smbios11
  - api_filtering_extended
  - acme_dns01
  - security_iommu
  - network_ipv4_dhcp_routes
  - network_state_ovn_ls
  - network_dns_nameservers
  - acme_http01_port
  - network_ovn_ipv4_dhcp_expiry
  - instance_state_cpu_time
  - network_io_bus
  - disk_io_bus_usb
  - storage_driver_linstor
  - instance_oci_entrypoint
  - network_address_set
  - server_logging
  - network_forward_snat
  - memory_hotplug
  - instance_nic_routed_host_tables
  - instance_publish_split
  - init_preseed_certificates
  - custom_volume_sftp
  - network_ovn_external_nic_address
  - network_physical_gateway_hwaddr
  - backup_s3_upload
  - snapshot_manual_expiry
  - resources_cpu_address_sizes
  - disk_attached
  - limits_memory_hotplug
  - disk_wwn
  - server_logging_webhook
  - storage_driver_truenas
  - container_disk_tmpfs
  - instance_limits_oom
  - backup_override_config
  - network_ovn_tunnels
  - init_preseed_cluster_groups
  - usb_attached
  - backup_iso
  - instance_systemd_credentials
  - cluster_group_usedby
  - bpf_token_delegation
  - file_storage_volume
  - network_hwaddr_pattern
  - storage_volume_full
  - storage_bucket_full
  - device_pci_firmware
  - resources_serial
  - ovn_nic_limits
  - storage_lvmcluster_qcow2
  - oidc_allowed_subnets
  - file_delete_force
  - nic_sriov_select_ext
  - network_zones_dns_contact
  - nic_attached_connected
  - nic_sriov_security_trusted
  - direct_backup
  - instance_snapshot_disk_only_restore
  - unix_hotplug_pci
  - cluster_evacuating_restoring
  - projects_restricted_image_servers
  - storage_lvmcluster_size
  - authorization_scriptlet_cert
  - lvmcluster_remove_snapshots
  - daemon_storage_logs
  - instances_debug_repair
  - network_io_bus_ovn
  - dependent
  - metrics_project_resources
api_status: stable
api_version: "1.0"
auth: trusted
public: false
auth_methods:
  - tls
auth_user_name: imanov
auth_user_method: unix
environment:
  addresses: []
  architectures:
    - x86_64
    - i686
  certificate: |
    -----BEGIN CERTIFICATE-----
    MIICEjCCAZmgAwIBAgIRAO1jqjb8CXa2VhCb4V69ZpEwCgYIKoZIzj0EAwMwODEZ
    MBcGA1UEChMQTGludXggQ29udGFpbmVyczEbMBkGA1UEAwwScm9vdEBsYXB0b3At
    aW1hbm92MB4XDTI2MDQwMjExNTgxNloXDTM2MDMzMDExNTgxNlowODEZMBcGA1UE
    ChMQTGludXggQ29udGFpbmVyczEbMBkGA1UEAwwScm9vdEBsYXB0b3AtaW1hbm92
    MHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEUXL8ZAalJmxcfglcyZjK9PsfYkDf3IR2
    lTFfR7/IpF4FfduC1tRdFFvz2ovNrDziJlLey9rKeYLlzxScw9KJZi0xiPs1+FuQ
    Zs6CNiY1bkUeGFLYVnoxD2xtJjTFqi/9o2cwZTAOBgNVHQ8BAf8EBAMCBaAwEwYD
    VR0lBAwwCgYIKwYBBQUHAwEwDAYDVR0TAQH/BAIwADAwBgNVHREEKTAngg1sYXB0
    b3AtaW1hbm92hwR/AAABhxAAAAAAAAAAAAAAAAAAAAABMAoGCCqGSM49BAMDA2cA
    MGQCMDt3ScqkLuevvYdXtLPGRdoEphlYLKL0cCc2KH0aSC8MXW0EMSoNqrVF57YW
    y5G3JwIwLKBQp1vpOWS+wiB7yT8nGyn02qGewzMYa4rHTkyfV6ezhBD4LX2Ll0ea
    lwQoeb7J
    -----END CERTIFICATE-----
  certificate_fingerprint: 1fbf66dba557936bf16b3dd3307225506a6cc80a0bbe8f104ba2b47390f8924c
  driver: lxc | qemu
  driver_version: 6.0.6 | 10.2.2
  firewall: nftables
  kernel: Linux
  kernel_architecture: x86_64
  kernel_features:
    idmapped_mounts: "true"
    netnsid_getifaddrs: "true"
    seccomp_listener: "true"
    seccomp_listener_continue: "true"
    uevent_injection: "true"
    unpriv_binfmt: "true"
    unpriv_fscaps: "true"
  kernel_version: 6.17.0-22-generic
  lxc_features:
    cgroup2: "true"
    core_scheduling: "true"
    devpts_fd: "true"
    idmapped_mounts_v2: "true"
    mount_injection_file: "true"
    network_gateway_device_route: "true"
    network_ipvlan: "true"
    network_l2proxy: "true"
    network_phys_macvlan_mtu: "true"
    network_veth_router: "true"
    pidfd: "true"
    seccomp_allow_deny_syntax: "true"
    seccomp_notify: "true"
    seccomp_proxy_send_notify_fd: "true"
  os_name: Ubuntu
  os_version: "25.10"
  project: default
  server: incus
  server_clustered: false
  server_event_mode: full-mesh
  server_name: laptop-imanov
  server_pid: 3340773
  server_version: "6.23"
  storage: lvm
  storage_version: 2.03.31(2) (2025-02-27) / 1.02.205 (2025-02-27) / 4.50.0
  storage_supported_drivers:
    - name: dir
      version: "1"
      remote: false
    - name: truenas
      version: 0.7.7
      remote: true
    - name: lvm
      version: 2.03.31(2) (2025-02-27) / 1.02.205 (2025-02-27) / 4.50.0
      remote: false

Instance details

$ incus config show u2604-plain 
architecture: x86_64
config:
  image.architecture: amd64
  image.description: Ubuntu resolute amd64 (20260427_07:42)
  image.os: Ubuntu
  image.release: resolute
  image.serial: "20260427_07:42"
  image.type: squashfs
  image.variant: cloud
  volatile.base_image: 780940b176e704845ac1f1ca51b8d0f7958a3731f1d0b1dc533a8ad5e814b337
  volatile.cloud-init.instance-id: 521171f2-d38f-4cf0-8c07-275e5d43fa68
  volatile.eth0.host_name: vethb2bc3c7e
  volatile.eth0.hwaddr: 10:66:6a:fa:b9:d0
  volatile.idmap.base: "0"
  volatile.idmap.current: '[{"Isuid":true,"Isgid":false,"Hostid":1000000,"Nsid":0,"Maprange":1000000000},{"Isuid":false,"Isgid":true,"Hostid":1000000,"Nsid":0,"Maprange":1000000000}]'
  volatile.idmap.next: '[{"Isuid":true,"Isgid":false,"Hostid":1000000,"Nsid":0,"Maprange":1000000000},{"Isuid":false,"Isgid":true,"Hostid":1000000,"Nsid":0,"Maprange":1000000000}]'
  volatile.last_state.idmap: '[]'
  volatile.last_state.power: RUNNING
  volatile.uuid: 1c24cf6b-c510-441d-b29d-c7d1e672b866
  volatile.uuid.generation: 1c24cf6b-c510-441d-b29d-c7d1e672b866
devices:
  root:
    path: /
    pool: lvm
    type: disk
ephemeral: false
profiles:
  - default
stateful: false
description: ""

$ incus config show u2604-unconfined 
architecture: x86_64
config:
  image.architecture: amd64
  image.description: Ubuntu resolute amd64 (20260427_07:42)
  image.os: Ubuntu
  image.release: resolute
  image.serial: "20260427_07:42"
  image.type: squashfs
  image.variant: cloud
  raw.lxc: lxc.apparmor.profile=unconfined
  volatile.base_image: 780940b176e704845ac1f1ca51b8d0f7958a3731f1d0b1dc533a8ad5e814b337
  volatile.cloud-init.instance-id: 8fcf19c5-2e72-4b68-928d-e75ec1593e23
  volatile.eth0.host_name: veth3d3285fc
  volatile.eth0.hwaddr: 10:66:6a:43:3d:4f
  volatile.idmap.base: "0"
  volatile.idmap.current: '[{"Isuid":true,"Isgid":false,"Hostid":1000000,"Nsid":0,"Maprange":1000000000},{"Isuid":false,"Isgid":true,"Hostid":1000000,"Nsid":0,"Maprange":1000000000}]'
  volatile.idmap.next: '[{"Isuid":true,"Isgid":false,"Hostid":1000000,"Nsid":0,"Maprange":1000000000},{"Isuid":false,"Isgid":true,"Hostid":1000000,"Nsid":0,"Maprange":1000000000}]'
  volatile.last_state.idmap: '[]'
  volatile.last_state.power: RUNNING
  volatile.uuid: 059332cd-51c6-423e-bf57-3661badb94b2
  volatile.uuid.generation: 059332cd-51c6-423e-bf57-3661badb94b2
devices:
  root:
    path: /
    pool: lvm
    type: disk
ephemeral: false
profiles:
  - default
stateful: false
description: ""

Instance log

$ incus info --show-log u2604-plain
Name: u2604-plain
Description: 
Status: RUNNING
Type: container
Architecture: x86_64
PID: 3573503
Created: 2026/04/29 10:54 CEST
Last Used: 2026/04/29 10:54 CEST
Started: 2026/04/29 10:54 CEST

Resources:
  Processes: 14
  Disk usage:
    root: 674.67MiB
  CPU usage:
    CPU usage (in seconds): 2
  Memory usage:
    Memory (current): 135.09MiB
  Network usage:
    eth0:
      Type: broadcast
      State: UP
      Host interface: vethb2bc3c7e
      MAC address: 10:66:6a:fa:b9:d0
      MTU: 1500
      Bytes received: 925B
      Bytes sent: 766B
      Packets received: 9
      Packets sent: 9
      IP addresses:
        inet6: fd42:c097:1e3:a088:1266:6aff:fefa:b9d0/64 (global)
        inet6: fe80::1266:6aff:fefa:b9d0/64 (link)
    lo:
      Type: loopback
      State: UP
      MTU: 65536
      Bytes received: 0B
      Bytes sent: 0B
      Packets received: 0
      Packets sent: 0
      IP addresses:
        inet:  127.0.0.1/8 (local)
        inet6: ::1/128 (local)

Log (lxc.log):

$ incus info --show-log u2604-unconfined 
Name: u2604-unconfined
Description: 
Status: RUNNING
Type: container
Architecture: x86_64
PID: 3577757
Created: 2026/04/29 10:55 CEST
Last Used: 2026/04/29 10:55 CEST
Started: 2026/04/29 10:55 CEST

Resources:
  Processes: 18
  Disk usage:
    root: 682.89MiB
  CPU usage:
    CPU usage (in seconds): 4
  Memory usage:
    Memory (current): 155.28MiB
  Network usage:
    eth0:
      Type: broadcast
      State: UP
      Host interface: veth3d3285fc
      MAC address: 10:66:6a:43:3d:4f
      MTU: 1500
      Bytes received: 3.02kB
      Bytes sent: 2.73kB
      Packets received: 25
      Packets sent: 29
      IP addresses:
        inet:  10.253.0.16/24 (global)
        inet6: fd42:c097:1e3:a088:1266:6aff:fe43:3d4f/64 (global)
        inet6: fe80::1266:6aff:fe43:3d4f/64 (link)
    lo:
      Type: loopback
      State: UP
      MTU: 65536
      Bytes received: 0B
      Bytes sent: 0B
      Packets received: 0
      Packets sent: 0
      IP addresses:
        inet:  127.0.0.1/8 (local)
        inet6: ::1/128 (local)

Log (lxc.log):

Current behavior

Disclaimer: This is an AI-assisted bug report.

Hi. I have been trying to use the latest ubuntu-26.04 images (cloud and non-cloud versions) to launch containers with incus. Apparently AppArmor is causing issues yet again... Denials all over the place!

Expected behavior

No response

Steps to reproduce

incus launch images:ubuntu/26.04/cloud u2604-plain
sleep 60
incus exec u2604-plain -- systemctl status --no-pager
incus exec u2604-plain -- systemctl list-units --state=activating --no-pager
incus exec u2604-plain -- ip -4 addr show eth0

Workaround Proof

incus launch images:ubuntu/26.04/cloud u2604-unconfined  -c raw.lxc='lxc.apparmor.profile=unconfined'
sleep 60
incus exec u2604-unconfined -- systemctl status --no-pager
incus exec u2604-unconfined -- ip -4 addr show eth0

[stgraber]

All our images go through automatic testing and can't hit the image server if they don't boot correctly or if the systemd status isn't clean.

I believe the issue on your end is indeed with Apparmor but not with the particular image, instead with the non-standard configuration that Ubuntu ships on the host.

See https://discuss.linuxcontainers.org/t/issues-in-ubuntu-26-04-apt-not-working-in-unprivileged-lxcs/26591/11

[shehi]

Well, the same setup is working just fine when I use Ubuntu 24.04 images, instead of 26.04 ones.

That URL is discussing the generic issue of AppArmor: I understand that one. I don't expect apt to work once cloud-init is run and the container is switched into confined mode. This is the case for Ubuntu 24 images as well. Nothing new there.

My report, however, doesn't focus on that generic issue: if you actually test the reproducable case I shared, you will see that Ubuntu 26 container isn't being assigned IPv4. That's why I dug deeper into the problem and discovered all this.

[shehi]

Deleted as it seems to be against TOS

[stgraber]

My report, however, doesn't focus on that generic issue: if you actually test the reproducable case I shared, you will see that Ubuntu 26 container isn't being assigned IPv4. That's why I dug deeper into the problem and discovered all this.

I did and as mentioned, we have our servers doing so for every single image before they're allowed to publish.

stgraber@castiana:~$ incus launch images:ubuntu/26.04/cloud u2604-plain
Launching u2604-plain
stgraber@castiana:~$ sleep 60                      
stgraber@castiana:~$ incus exec u2604-plain -- systemctl status --no-pager
● u2604-plain
    State: running
    Units: 257 loaded (incl. loaded aliases)
     Jobs: 0 queued
   Failed: 0 units
    Since: Wed 2026-04-29 13:02:09 UTC; 1min 13s ago
  systemd: 259.5-0ubuntu3
  Tainted: unmerged-bin
   CGroup: /
           ├─.lxc
           │ └─565 systemctl status --no-pager
           ├─init.scope
           │ └─1 /sbin/init
           └─system.slice
             ├─console-getty.service
             │ └─494 /sbin/agetty -o "-- \\u" --noreset --noclear --keep-baud 115200,57600,38400,9600 console
             ├─cron.service
             │ └─477 /usr/sbin/cron -f -P
             ├─dbus.service
             │ └─478 @dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only
             ├─polkit.service
             │ └─519 /usr/lib/polkit-1/polkitd --no-debug --log-level=notice
             ├─rsyslog.service
             │ └─503 /usr/sbin/rsyslogd -n -iNONE
             ├─systemd-journald.service
             │ └─124 /usr/lib/systemd/systemd-journald
             ├─systemd-logind.service
             │ └─482 /usr/lib/systemd/systemd-logind
             ├─systemd-networkd.service
             │ └─440 /usr/lib/systemd/systemd-networkd
             ├─systemd-resolved.service
             │ └─168 /usr/lib/systemd/systemd-resolved
             ├─systemd-udevd.service
             │ └─udev
             │   └─178 /usr/lib/systemd/systemd-udevd
             └─unattended-upgrades.service
               └─515 /usr/bin/python3 /usr/share/unattended-upgrades/unattended-upgrade-shutdown --wait-for-signal
stgraber@castiana:~$ 
stgraber@castiana:~$ incus exec u2604-plain -- systemctl list-units --state=activating --no-pager
  UNIT LOAD ACTIVE SUB DESCRIPTION

0 loaded units listed.
stgraber@castiana:~$ incus exec u2604-plain -- ip -4 addr show eth0
145: eth0@if146: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000 link-netnsid 0
    inet 10.244.64.244/24 metric 100 brd 10.244.64.255 scope global dynamic eth0
       valid_lft 3512sec preferred_lft 3512sec
stgraber@castiana:~$ 

[stgraber]

Instead of pushing large amounts of AI debug slop (which is against our policies, see LLM policy in CONTRIBUTING.md), did you actually try applying the suggested fix from the forum post I linked?

sudo sysctl -w kernel.apparmor_restrict_unprivileged_unconfined=0 

[shehi]

Instead of pushing large amounts of AI debug slop (which is against our policies, see LLM policy in CONTRIBUTING.md), did you actually try applying the suggested fix from the forum post I linked?

sudo sysctl -w kernel.apparmor_restrict_unprivileged_unconfined=0 

I didn't because as I understand it lifts incus's unprivileged usage (--user=1000) confinement, which technically disables AppArmor there. Am I wrong? I don't want that. I want confinement to stay there.

It is strange. I ran the same sequence of commands (exception being I added -s lvm option to launch): U26 hangs, U24 runs smoothly. I didn't add anything else to my machine, haven't customized anything:

$ incus launch images:ubuntu/26.04/cloud u2604-plain -s lvm && sleep 60 &&  incus exec u2604-plain -- systemctl status --no-pager && incus exec u2604-plain -- systemctl list-units --state=activating --no-pager && incus exec u2604-plain -- ip -4 addr show eth0
Launching u2604-plain
● u2604-plain
    State: initializing
    Units: 260 loaded (incl. loaded aliases)
     Jobs: 58 queued
   Failed: 0 units
    Since: Wed 2026-04-29 13:15:45 UTC; 1min 0s ago
  systemd: 259.5-0ubuntu3
  Tainted: unmerged-bin
   CGroup: /
           ├─.lxc
           │ └─285 systemctl status --no-pager
           ├─init.scope
           │ └─1 /sbin/init
           └─system.slice
             ├─cloud-init-main.service
             │ ├─ 64 /usr/bin/python3 /usr/bin/cloud-init --all-stages
             │ ├─215 /bin/sh -c "tee -a /var/log/cloud-init-output.log"
             │ └─216 tee -a /var/log/cloud-init-output.log
             ├─systemd-journald.service
             │ ├─52 "(systemd-journald)"
             │ └─58 "(sd-mkuserns)"
             ├─systemd-networkd.service
             │ ├─258 "(systemd-networkd)"
             │ └─259 "(sd-mkuserns)"
             ├─systemd-resolved.service
             │ ├─85 "(systemd-resolved)"
             │ └─88 "(sd-mkuserns)"
             ├─systemd-udev-trigger.service
             │ └─60 udevadm trigger --type=all --action=add --prioritized-subsystem=module,block,tpmrm,net,tty,input
             └─systemd-udevd.service
               └─udev
                 ├─ 91 /usr/lib/systemd/systemd-udevd
                 ├─117 "(udev-worker)"
                 └─118 "(udev-worker)"
  UNIT                         LOAD   ACTIVE     SUB       JOB   DESCRIPTION              
● dev-dm\x2d8.device           loaded activating tentative       /dev/dm-8                
● systemd-journald.service     loaded activating start     start Journal Service
● systemd-networkd.service     loaded activating start     start Network Management
● systemd-resolved.service     loaded activating start     start Network Name Resolution
● systemd-udev-trigger.service loaded activating start     start Coldplug All udev Devices

Legend: LOAD   → Reflects whether the unit definition was properly loaded.
        ACTIVE → The high-level unit activation state, i.e. generalization of SUB.
        SUB    → The low-level unit activation state, values depend on unit type.
        JOB    → Pending job for the unit.

5 loaded units listed.
imanov@laptop-imanov ~/Projects/Medipa/OpenToFu/src/main (master)
$ incus launch images:ubuntu/24.04/cloud u2404-plain -s lvm && sleep 60 &&  incus exec u2404-plain -- systemctl status --no-pager && incus exec u2404-plain -- systemctl list-units --state=activating --no-pager && incus exec u2404-plain -- ip -4 addr show eth0
Launching u2404-plain
● u2404-plain
    State: running
    Units: 252 loaded (incl. loaded aliases)
     Jobs: 0 queued
   Failed: 0 units
    Since: Wed 2026-04-29 13:18:04 UTC; 1min 0s ago
  systemd: 255.4-1ubuntu8.15
   CGroup: /
           ├─.lxc
           │ └─307 systemctl status --no-pager
           ├─init.scope
           │ └─1 /sbin/init
           └─system.slice
             ├─console-getty.service
             │ └─230 /sbin/agetty -o "-p -- \\u" --noclear --keep-baud - 115200,38400,9600 linux
             ├─cron.service
             │ └─221 /usr/sbin/cron -f -P
             ├─dbus.service
             │ └─222 @dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only
             ├─polkit.service
             │ └─242 /usr/lib/polkit-1/polkitd --no-debug
             ├─rsyslog.service
             │ └─236 /usr/sbin/rsyslogd -n -iNONE
             ├─systemd-journald.service
             │ └─48 /usr/lib/systemd/systemd-journald
             ├─systemd-logind.service
             │ └─226 /usr/lib/systemd/systemd-logind
             ├─systemd-networkd.service
             │ └─180 /usr/lib/systemd/systemd-networkd
             ├─systemd-resolved.service
             │ └─120 /usr/lib/systemd/systemd-resolved
             ├─systemd-udevd.service
             │ └─udev
             │   ├─111 /usr/lib/systemd/systemd-udevd
             │   ├─130 "(udev-worker)"
             │   └─131 "(udev-worker)"
             └─unattended-upgrades.service
               └─238 /usr/bin/python3 /usr/share/unattended-upgrades/unattended-upgrade-shutdown --wait-for-signal
  UNIT               LOAD   ACTIVE     SUB       DESCRIPTION
  dev-dm\x2d9.device loaded activating tentative /dev/dm-9

Legend: LOAD   → Reflects whether the unit definition was properly loaded.
        ACTIVE → The high-level unit activation state, i.e. generalization of SUB.
        SUB    → The low-level unit activation state, values depend on unit type.

1 loaded units listed.
155: eth0@if156: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000 link-netnsid 0
    inet 10.253.0.239/24 metric 100 brd 10.253.0.255 scope global dynamic eth0
       valid_lft 3542sec preferred_lft 3542sec

And why in my case U26 says Units: 260 loaded, in your case it says 257 loaded? Not sure if that matters in any way.

[stgraber]

I didn't because as I understand it lifts incus's unprivileged usage (--user=1000) confinement, which technically disables AppArmor there. Am I wrong? I don't want that. I want confinement to stay there.

You're wrong. The sysctl is to disable an Ubuntu-specific extension to AppArmor which applied additional restrictions to user namespaces. Turning it off gets you back to the normal behavior that everyone else is getting with AppArmor.

It's been noted that the LXD snap on Ubuntu as well as containerd have packaging workarounds in place to set that sysctl to 0 automatically to get things working out of the box, so there's really no issue with setting it.

[stgraber]

And why in my case U26 says Units: 260 loaded, in your case it says 257 loaded? Not sure if that matters in any way.

On my side I'm on Debian 13 with Linux 6.19.11 and AppArmor 4.1.0. The exact unit count tends to vary system to system even in containers as systemd spawns virtual units based on mount points, loaded kernel modules and even hardware devices on the system (which are still visible in containers).

[shehi]

I didn't because as I understand it lifts incus's unprivileged usage (--user=1000) confinement, which technically disables AppArmor there. Am I wrong? I don't want that. I want confinement to stay there.

You're wrong. The sysctl is to disable an Ubuntu-specific extension to AppArmor which applied additional restrictions to user namespaces. Turning it off gets you back to the normal behavior that everyone else is getting with AppArmor.

It's been noted that the LXD snap on Ubuntu as well as containerd have packaging workarounds in place to set that sysctl to 0 automatically to get things working out of the box, so there's really no issue with setting it.

Thank you for all the valuable information. I will try to disable the flag via OpenToFu then.

And why in my case U26 says Units: 260 loaded, in your case it says 257 loaded? Not sure if that matters in any way.

On my side I'm on Debian 13 with Linux 6.19.11 and AppArmor 4.1.0. The exact unit count tends to vary system to system even in containers as systemd spawns virtual units based on mount points, loaded kernel modules and even hardware devices on the system (which are still visible in containers).

I am on Ubuntu 25.10 - an unsupported OS I believe... Thank you again, for your time!

[stgraber]

I've pushed this change:
zabbly/incus@39ef290

Which will eventually make it to all the packages and will hopefully ensure the setting is set to 0 everywhere Incus is run.