Hello !! Thank you very much for the forum. I have installed a server with proxmox and this week when I update it to version 7, I find that the ct does not start. It shows me an apparmor error, I have searched a lot on google and this same forum, I have tried to execute the various solutions of the posts that I have read, and unfortunately none have given me the solution. Because they still can't start the ct. I have created a new test ct with debian and it does not work for me either. if anyone could give me a hand i would be very grateful. I leave here the different outputs that the commands in proxmox give me. Thank you.
[SOLVED] Failed to start CT - ( Failed to start Load AppArmor profiles )
- Thread starter Kudaki
- Start date
Thank you very much for answering me.
I don't speak much English, I am using google translator.
These are the outputs that the commands you have requested give me.
The error keeps showing up on proxmox version 7.0-13. Currently I get to have the container running on another server with proxmox 6.2-4. The error message is as follows.
I don't speak much English, I am using google translator.
These are the outputs that the commands you have requested give me.
The error keeps showing up on proxmox version 7.0-13. Currently I get to have the container running on another server with proxmox 6.2-4. The error message is as follows.
Last edited:
Here it is !!! Thank you very much for the help!!!
root@pve:~# pct start 105 --debug
run_apparmor_parser: 919 Failed to run apparmor_parser on "/var/lib/lxc/105/appa rmor/lxc-105_<-var-lib-lxc>": AppArmor parser error for /var/lib/lxc/105/apparmo r/lxc-105_<-var-lib-lxc> in /var/lib/lxc/105/apparmor/lxc-105_<-var-lib-lxc> at line 1: Could not open 'tunables/global'
apparmor_prepare: 1089 Failed to load generated AppArmor profile
lxc_init: 850 Failed to initialize LSM
__lxc_start: 2007 Failed to initialize container "105"
r "105", config section "lxc"
DEBUG terminal - terminal.c:lxc_terminal_peer_default:665 - No such device - The process does not have a controlling terminal
DEBUG seccomp - seccomp.carse_config_v2:656 - Host native arch is [32212255 34]
INFO seccomp - seccomp.c
INFO seccomp - seccomp.c:do_resolve_add_rule:524 - Set seccomp rule to rejec t force umounts
INFO seccomp - seccomp.c:do_resolve_add_rule:524 - Set seccomp rule to rejec t force umounts
INFO seccomp - seccomp.c:do_resolve_add_rule:524 - Set seccomp rule to rejec t force umounts
INFO seccomp - seccomp.c
INFO seccomp - seccomp.c
INFO seccomp - seccomp.c:do_resolve_add_rule:564 - Adding native rule for sy scall[246:kexec_load] action[327681:errno] arch[0]
INFO seccomp - seccomp.c:do_resolve_add_rule:564 - Adding compat rule for sy scall[246:kexec_load] action[327681:errno] arch[1073741827]
INFO seccomp - seccomp.c:do_resolve_add_rule:564 - Adding compat rule for sy scall[246:kexec_load] action[327681:errno] arch[1073741886]
INFO seccomp - seccomp.c
INFO seccomp - seccomp.c:do_resolve_add_rule:564 - Adding native rule for sy scall[304pen_by_handle_at] action[327681:errno] arch[0]
INFO seccomp - seccomp.c:do_resolve_add_rule:564 - Adding compat rule for sy scall[304
INFO seccomp - seccomp.c:do_resolve_add_rule:564 - Adding compat rule for sy scall[304
INFO seccomp - seccomp.c
INFO seccomp - seccomp.c:do_resolve_add_rule:564 - Adding native rule for sy scall[175:init_module] action[327681:errno] arch[0]
INFO seccomp - seccomp.c:do_resolve_add_rule:564 - Adding compat rule for sy scall[175:init_module] action[327681:errno] arch[1073741827]
INFO seccomp - seccomp.c:do_resolve_add_rule:564 - Adding compat rule for sy scall[175:init_module] action[327681:errno] arch[1073741886]
INFO seccomp - seccomp.c
INFO seccomp - seccomp.c:do_resolve_add_rule:564 - Adding native rule for sy scall[313:finit_module] action[327681:errno] arch[0]
INFO seccomp - seccomp.c:do_resolve_add_rule:564 - Adding compat rule for sy scall[313:finit_module] action[327681:errno] arch[1073741827]
INFO seccomp - seccomp.c:do_resolve_add_rule:564 - Adding compat rule for sy scall[313:finit_module] action[327681:errno] arch[1073741886]
INFO seccomp - seccomp.c
INFO seccomp - seccomp.c:do_resolve_add_rule:564 - Adding native rule for sy scall[176:delete_module] action[327681:errno] arch[0]
INFO seccomp - seccomp.c:do_resolve_add_rule:564 - Adding compat rule for sy scall[176:delete_module] action[327681:errno] arch[1073741827]
INFO seccomp - seccomp.c:do_resolve_add_rule:564 - Adding compat rule for sy scall[176:delete_module] action[327681:errno] arch[1073741886]
INFO seccomp - seccomp.c
INFO seccomp - seccomp.c:do_resolve_add_rule:547 - arg_cmp[0]: SCMP_CMP(1, 7 , 65280, 37888)
INFO seccomp - seccomp.c:do_resolve_add_rule:564 - Adding native rule for sy scall[16:ioctl] action[327681:errno] arch[0]
INFO seccomp - seccomp.c:do_resolve_add_rule:547 - arg_cmp[0]: SCMP_CMP(1, 7 , 65280, 37888)
INFO seccomp - seccomp.c:do_resolve_add_rule:564 - Adding compat rule for sy scall[16:ioctl] action[327681:errno] arch[1073741827]
INFO seccomp - seccomp.c:do_resolve_add_rule:547 - arg_cmp[0]: SCMP_CMP(1, 7 , 65280, 37888)
INFO seccomp - seccomp.c:do_resolve_add_rule:564 - Adding compat rule for sy scall[16:ioctl] action[327681:errno] arch[1073741886]
INFO seccomp - seccomp.c
INFO seccomp - seccomp.c:do_resolve_add_rule:564 - Adding native rule for sy scall[250:keyctl] action[327718:errno] arch[0]
INFO seccomp - seccomp.c:do_resolve_add_rule:564 - Adding compat rule for sy scall[250:keyctl] action[327718:errno] arch[1073741827]
INFO seccomp - seccomp.c:do_resolve_add_rule:564 - Adding compat rule for sy scall[250:keyctl] action[327718:errno] arch[1073741886]
INFO seccomp - seccomp.c
ERROR apparmor - lsm/apparmor.c:run_apparmor_parser:919 - Failed to run appar mor_parser on "/var/lib/lxc/105/apparmor/lxc-105_<-var-lib-lxc>": AppArmor parse r error for /var/lib/lxc/105/apparmor/lxc-105_<-var-lib-lxc> in /var/lib/lxc/105 /apparmor/lxc-105_<-var-lib-lxc> at line 1: Could not open 'tunables/global'
ERROR apparmor - lsm/apparmor.c:apparmor_prepare:1089 - Failed to load genera ted AppArmor profile
ERROR start - start.c:lxc_init:850 - Failed to initialize LSM
ERROR start - start.c:__lxc_start:2007 - Failed to initialize container "105"
WARN cgfsng - cgroups/cgfsng.c:cgfsng_payload_destroy:538 - Uninitialized li mit cgroup
WARN cgfsng - cgroups/cgfsng.c:cgfsng_monitor_destroy:904 - Uninitialized mo nitor cgroup
INFO conf - conf.c:run_script_argv:332 - Executing script "/usr/share/lxcfs/ lxc.reboot.hook" for container "105", config section "lxc"
startup for container '105' failed
the error seems to be:
do you have this file on your system:
you could check the output of the following command:
should look like the following:
also for the next time you're posting outputs please use
Code:
run_apparmor_parser: 919 Failed to run apparmor_parser on "/var/lib/lxc/105/apparmor/lxc-105_<-var-lib-lxc>": AppArmor parser error for /var/lib/lxc/105/apparmor/lxc-105_<-var-lib-lxc> in /var/lib/lxc/105/apparmor/lxc-105_<-var-lib-lxc> at line 1: Could not open 'tunables/global'do you have this file on your system:
/etc/apparmor.d/tunables/globalyou could check the output of the following command:
ls -al /etc/apparmor.d/tunables/should look like the following:
Code:
root@pve:~# ls -al /etc/apparmor.d/tunables/
total 52
drwxr-xr-x 1 root root 242 Aug 4 11:32 .
drwxr-xr-x 1 root root 296 Aug 4 11:38 ..
-rw-r--r-- 1 root root 624 Apr 3 2021 alias
-rw-r--r-- 1 root root 376 Apr 3 2021 apparmorfs
-rw-r--r-- 1 root root 804 Apr 3 2021 dovecot
-rw-r--r-- 1 root root 744 Apr 3 2021 global
-rw-r--r-- 1 root root 983 Apr 3 2021 home
drwxr-xr-x 1 root root 32 Aug 4 11:32 home.d
-rw-r--r-- 1 root root 1391 Apr 3 2021 kernelvars
-rw-r--r-- 1 root root 631 Apr 3 2021 multiarch
drwxr-xr-x 1 root root 20 Aug 4 11:32 multiarch.d
-rw-r--r-- 1 root root 440 Apr 3 2021 proc
-rw-r--r-- 1 root root 23 Apr 3 2021 run
-rw-r--r-- 1 root root 405 Apr 3 2021 securityfs
-rw-r--r-- 1 root root 819 Apr 3 2021 share
-rw-r--r-- 1 root root 378 Apr 3 2021 sys
-rw-r--r-- 1 root root 868 Apr 3 2021 xdg-user-dirs
drwxr-xr-x 1 root root 20 Aug 4 11:32 xdg-user-dirs.dalso for the next time you're posting outputs please use
[code][/code] tags It seems that the error is there, indeed the directory does not look like that.
Let's see if I don't screw up when I post the result.
Let's see if I don't screw up when I post the result.
Code:
root@pve:/# ls -al /etc/apparmor.d/tunables/
total 24
drwxrwxrwx 5 root root 4096 Oct 14 12:00 .
drwxrwxrwx 7 root root 4096 Oct 14 12:00 ..
drwxr-xr-x 2 root root 4096 Oct 14 12:00 home.d
drwxr-xr-x 2 root root 4096 Oct 14 12:00 multiarch.d
-rw-r--r-- 1 root root 428 Oct 14 11:07 proc
drwxr-xr-x 2 root root 4096 Oct 14 11:49 xdg-user-dirs.dokay, please try the following:It seems that the error is there, indeed the directory does not look like that.
Let's see if I don't screw up when I post the result.
Code:root@pve:/# ls -al /etc/apparmor.d/tunables/ total 24 drwxrwxrwx 5 root root 4096 Oct 14 12:00 . drwxrwxrwx 7 root root 4096 Oct 14 12:00 .. drwxr-xr-x 2 root root 4096 Oct 14 12:00 home.d drwxr-xr-x 2 root root 4096 Oct 14 12:00 multiarch.d -rw-r--r-- 1 root root 428 Oct 14 11:07 proc drwxr-xr-x 2 root root 4096 Oct 14 11:49 xdg-user-dirs.d
Code:
$ mkdir foo
$ cd foo
$ wget https://debian-repo.stanford.edu/debian/pool/main/a/apparmor/apparmor_2.13.6.orig.tar.gz
$ tar xzvf *.tar.gz
$ cp -r apparmor*/profiles/apparmor.d/tunables/ /etc/apparmor.dand then try starting the container. if it still doesn't work you can try with the
--debug option again (maybe other files are missing as well...)Many thanks !!!! at the end the container has started. I get a message of warnings -1, but it has managed to start. I guess now, to remove that warnings message, Do I have to do ... "pct enter 105" from the console and update the container with "yum update"?
Code:
root@pve:/foo# pct start 105
WARN: old systemd (< v232) detected, container won't run in a pure cgroupv2 environment! Please see documentation -> container -> cgroup version.
Task finished with 1 warning(s)!
root@pve:/foo#great! you're welcome
yes, i guess you were using centos 7 so that's why you'd get that warning. see our documentation section [0] for our recommendations (one of them is upgrading to centos 8)
[0]: https://pve.proxmox.com/pve-docs/chapter-pct.html#pct_cgroup_compat
you should be able to run
ifup eth0 inside the container and then it can workgreat you're welcome