That's docker problem versus apparmor, not PVE related. Debian 12 didn't have active apparmor, but debian 13 has it by default. I encountered the same problem with giltab-runner + docker. Profile docker-default is created by docker service on the fly, so you have two options:
1]...