CVE-2025-52881 breaks docker LXC containers

[jay747]

Over the weekend I did an update of my Debian LXC container running docker and none of my dockers where starting due to a patch https://securityvulnerability.io/vulnerability/CVE-2025-52881

Every time I tried to start an docker container it comes up with the below error

Error response from daemon: failed to create task for container: failed to create shim task: OCI runtime create failed: runc create failed: unable to start container process: error during container init: open sysctl net.ipv4.ip_unprivileged_port_start file: reopen fd 8: permission denied: unknown.

I have found a fix for it https://github.com/opencontainers/runc/issues/4968

You instead need to add the following configuration to /etc/pve/lxc/$ctr.conf:

lxc.apparmor.profile: unconfined
lxc.mount.entry: /dev/null sys/module/apparmor/parameters/enabled none bind 0 0

And restart the container.

 

[nmateo]

I think running docker in LXC containers is not recommended.

 

[Johannes S]

See: https://forum.proxmox.com/threads/d...rivileged_port_start-error.175437/post-814307

 

[leesteken]

I don't think that disabling/unconfining apparmor/security is a good response to a security fix in general, but I don't know the details about any of the things in this thread.

 

[Johannes S]

I agree, the bug report in bugzilla (https://bugzilla.proxmox.com/show_bug.cgi?id=7006 ) mentions a bugfix in lxc upstream: https://github.com/lxc/incus/pull/2624
The fix basically disabled some of the AppArmor rules for lxc if the container is nested. This is a lot better than the "workaround" to add
lxc.apparmor.profile: unconfined to the lxc configuration since that basically disables AppArmor completly for the lxc.