community-scripts/ProxmoxVED
5
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Improve Docker AppArmor workaround for LXC

Browse Source 
Moves AppArmor workaround to run before Docker installation and enhances the workaround in tools.func by adding an unmount step, updating the systemd service to use sysinit.target, and adding verification of the mount. Provides clearer feedback if the workaround is not active.
This commit is contained in:
CanbiZ 2025-11-07 13:44:57 +01:00
parent 0379c6dbe3
commit 2d42c0b2be
2 changed files with 18 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
install/docker-install.sh
View File

@ -13,6 +13,10 @@ setting_up_container
network_check network_check
update_os update_os
# Apply AppArmor workaround BEFORE installing Docker
# See: https://github.com/opencontainers/runc/issues/4968
apply_docker_apparmor_workaround
get_latest_release() { get_latest_release() {
curl -fsSL https://api.github.com/repos/"$1"/releases/latest | grep '"tag_name":' | cut -d'"' -f4 curl -fsSL https://api.github.com/repos/"$1"/releases/latest | grep '"tag_name":' | cut -d'"' -f4
} }
@ -29,9 +33,6 @@ echo -e '{\n "log-driver": "journald"\n}' >/etc/docker/daemon.json
$STD sh <(curl -fsSL https://get.docker.com) $STD sh <(curl -fsSL https://get.docker.com)
msg_ok "Installed Docker $DOCKER_LATEST_VERSION" msg_ok "Installed Docker $DOCKER_LATEST_VERSION"
# Apply AppArmor workaround BEFORE installing Docker
# See: https://github.com/opencontainers/runc/issues/4968
apply_docker_apparmor_workaround
# Restart Docker to apply AppArmor workaround (if running in LXC) # Restart Docker to apply AppArmor workaround (if running in LXC)
$STD systemctl restart docker $STD systemctl restart docker

19
misc/tools.func
View File

@ -55,26 +55,30 @@ apply_docker_apparmor_workaround() {
msg_info "Applying Docker AppArmor workaround for LXC" msg_info "Applying Docker AppArmor workaround for LXC"
# Apply the mount bind workaround immediately # Method 1: Mount bind /dev/null over AppArmor enabled file
if [ -f /sys/module/apparmor/parameters/enabled ]; then if [ -f /sys/module/apparmor/parameters/enabled ]; then
# Unmount first if already mounted
umount /sys/module/apparmor/parameters/enabled 2>/dev/null || true
# Apply mount
mount --bind /dev/null /sys/module/apparmor/parameters/enabled 2>/dev/null || true mount --bind /dev/null /sys/module/apparmor/parameters/enabled 2>/dev/null || true
fi fi
# Create systemd service for persistence (preferred over rc.local) # Method 2: Create systemd service for persistence
cat >/etc/systemd/system/docker-apparmor-workaround.service <<'EOF' cat >/etc/systemd/system/docker-apparmor-workaround.service <<'EOF'
[Unit] [Unit]
Description=Docker AppArmor workaround for LXC Description=Docker AppArmor workaround for LXC
Documentation=https://github.com/opencontainers/runc/issues/4968 Documentation=https://github.com/opencontainers/runc/issues/4968
Before=docker.service containerd.service Before=docker.service containerd.service
ConditionPathExists=/sys/module/apparmor/parameters/enabled DefaultDependencies=no
[Service] [Service]
Type=oneshot Type=oneshot
ExecStartPre=-/bin/umount /sys/module/apparmor/parameters/enabled
ExecStart=/bin/mount --bind /dev/null /sys/module/apparmor/parameters/enabled ExecStart=/bin/mount --bind /dev/null /sys/module/apparmor/parameters/enabled
RemainAfterExit=yes RemainAfterExit=yes
[Install] [Install]
WantedBy=multi-user.target WantedBy=sysinit.target
EOF EOF
# Enable and start the service # Enable and start the service
@ -82,7 +86,12 @@ EOF
$STD systemctl enable docker-apparmor-workaround.service $STD systemctl enable docker-apparmor-workaround.service
$STD systemctl start docker-apparmor-workaround.service 2>/dev/null || true $STD systemctl start docker-apparmor-workaround.service 2>/dev/null || true
msg_ok "Applied Docker AppArmor workaround" # Verify the mount is active
if mount | grep -q "on /sys/module/apparmor/parameters/enabled"; then
msg_ok "Applied Docker AppArmor workaround"
else
msg_warn "AppArmor workaround may not be active - please check 'mount | grep apparmor'"
fi
} }
# ------------------------------------------------------------------------------ # ------------------------------------------------------------------------------