In documentation is written:
If you want to disable AppArmor for a container, you can add the stanza
lxc.aa_profile = unconfined
at the end of the configuration file ( located in /etc/pve/lxc/CTID.conf ) Note that this is not a recommended setup for production.
But sorry, we get again...