LXC Apparmour errors in containers

[sahostking]

I have been noticing errors for example like this in containers /var/log/messages that the error should not be complaining on.

For example in container 230 this error shows in /var/log/messages

Apr 5 14:17:10 wit kernel: [2434869.384450] audit: type=1400 audit(1586089030.548:16540): apparmor="DENIED" operation="mount" info="failed flags match" error=-13 profile="lxc-216_</var/lib/lxc>" name="/tmp/" pid=16228 comm="(openvpn)" flags="rw, remount, bind"

But that error is related to an issue of container 216

Kindly assist so we hide this from customers its not related to as it creates confusion.

Thanks

 

[oguz]

hi,

containers use the same kernel as the host, which consequently means they share the kernel. this is because of how lxc works.

if you want full separation, you need to use a VM.

quoting from [0]:

Containers are a lightweight alternative to fully virtualized machines (VMs). They use the kernel of the host system that they run on, instead of emulating a full operating system (OS). This means that containers can access resources on the host system directly.

[0]: https://pve.proxmox.com/wiki/Linux_Container