Unable to use Docker in the ubuntu template because of AppArmor Permission denied #28
Labels
🧐 Not a Script Issue
Not a Script Issue
Comments
|
From a fresh Ubuntu 21.10 LXC install, run the below needs to be added to the LXC #lxc.apparmor.profile: unconfined
lxc.cgroup2.devices.allow: a
lxc.cap.drop: from the Proxmox Shell run ( replace |
|
I just did. There is essentially no difference in installing docker with the script or manually. The apparmor error is still there. |
|
The below needs to be added to the LXC #lxc.apparmor.profile: unconfined
lxc.cgroup2.devices.allow: a
lxc.cap.drop: from the Proxmox Shell run ( replace |
Quote from here. From a security point this seems like a bad choice. There are other ways to keep access to privileged features like |
|
Then OMIT that line! |
That is no solution to the problem. |
|
What solution/problem? That line can be omitted and Docker will run fine. I'm guessing you haven't tried. |
|
I've tried and the apparmor error is still there. |
|
Did you reboot the LXC after the |
|
Yes, I did. |
|
I'm going to install Ubuntu 21.10 LXC with the above method, omitting the apparmor line. I'll post my findings |
|
Great, thanks! |
|
As I suspected, it works just fine. root@ubuntu:~# docker run hello-world
Unable to find image 'hello-world:latest' locally
latest: Pulling from library/hello-world
2db29710123e: Pull complete
Digest: sha256:507ecde44b8eb741278274653120c2bf793b174c06ff4eaa672b713b3263477b
Status: Downloaded newer image for hello-world:latest
Hello from Docker!
This message shows that your installation appears to be working correctly.
To generate this message, Docker took the following steps:
1. The Docker client contacted the Docker daemon.
2. The Docker daemon pulled the "hello-world" image from the Docker Hub.
(amd64)
3. The Docker daemon created a new container from that image which runs the
executable that produces the output you are currently reading.
4. The Docker daemon streamed that output to the Docker client, which sent it
to your terminal.
To try something more ambitious, you can run an Ubuntu container with:
$ docker run -it ubuntu bash
Share images, automate workflows, and more with a free Docker ID:
https://hub.docker.com/
For more examples and ideas, visit:
https://docs.docker.com/get-started/
|
|
Which Proxmox are you running? |
|
Version 7.1-10 |
|
That is strange. I'm on the same version. Can you post your |
arch: amd64
cores: 2
features: nesting=1
hostname: ubuntu
memory: 2048
net0: name=eth0,bridge=vmbr0,hwaddr=BA:97:7B:37:FC:66,ip=dhcp,type=veth
onboot: 1
ostype: ubuntu
rootfs: local-lvm:vm-109-disk-0,size=6G
swap: 512
lxc.cgroup2.devices.allow: a
lxc.cap.drop: |
|
I have a feeling that you have borked up your LXC |
|
I don't think so. I might know the cause. You are running it on a lvm volume and I'm running it on a zpool. I can't verify this because all my Proxmox machines are zfs based but this could be the reason. I've read in the past, that there are issues with running docker on a zpool with Proxmox. I was under the impression that this was only related to running on the hypervisor and not inside a lxc container. |
|
Try this, install Home Assistant Container LXC, which runs Docker, but if a ZFS filesystem is detected, it will automatically setup static fuse-overlayfs |
|
I just did. Yes, it's using static fuse-overlayfs. What exactly does this proofs? Please help me out here. |
|
now run |
It works but my original issue still persists because I'm in a situation where I do need a Ubuntu 21.10 based lxc container with access to |
|
Ubuntu is Debian based. Why just Ubuntu? |
|
Explain what you're trying to do... |
|
Essentially because in the past I had some major issues with hardware encoding/decoding on Debian and Ubuntu is much more recent. The endgame is to run a GamesonWhale Docker for low latency based desktop streaming on a headless Proxmox. If you want to provide a lxc template for that I would be thrilled to help or a general based docker lxc which is based on ubuntu for that matter. |
|
Try this That is a Gamers Docker setup with Hardware Acceleration already added |
|
Thanks! I pulled it. Docker runs without the aforementioned apparmor error. So the original issue is closed. There are some other things though in regards to the dependencies of the GamesOnWhales docker. It needs a |
|
add this to the |
|
Now |
|
You may want to fork this repo before I remove the dev branch. Good luck with your GoW |
|
Thanks again for your help. I forked it. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
I followed the offficial docker install instructions but I'm unable to use Docker because of an AppArmor error. Not sure if this related to your template or to Proxmox 7.1 itself but it would be nice to have a docker specific lxc template if there is any further configuration necessary. I think this might be related to the fact that the lxc container is privileged.
Removing AppArmor with
apt remove apparmorworks around the issue but this doesn't seem to be a good idea.The text was updated successfully, but these errors were encountered: