Allow devpts mounts for LXC

[Chais]

I have a container that I use to maintain and host my personal repository of Arch packages. I build those in systemd-nspawn containers so I have nesting enabled.
This setup used to work until a few weeks ago when a SystemD update rolled around.
After some investigation I found the culprit to be AppArmor (again!) which blocks devpts mounts for LXC.
Now ideally I'd like to allow for devpts mounts if the newinstance option is present, but I couldn't find a way to specify this in the AppArmor policy. It allows specifying exact matches of options (exactly these options) or super-sets of options (any of these options, but not others). Requiring a certain option and ignoring others doesn't seem to be an option.
If that is indeed impossible I'd like to unconfine this container from AppArmor. Setting the respective option in

/var/lib/lxc/<id>/config

had no effect as the file was re-written as soon as I restarted the container. Any hints on this approach?

Thanks in advance.

 

[oguz]

hi,

This setup used to work until a few weeks ago when a SystemD update rolled around.
After some investigation I found the culprit to be AppArmor (again!) which blocks devpts mounts for LXC.

could you elaborate a little bit about how you investigated the issue?

f that is indeed impossible I'd like to unconfine this container from AppArmor. Setting the respective option in /var/lib/lxc/<id>/config had no effect as the file was re-written as soon as I restarted the container. Any hints on this approach?

for the record, in PVE you shouldn't edit this file and instead the /etc/pve/lxc/<ctid>.conf

however when i was trying to reproduce this issue, with the unconfined apparmor profile it still didn't work