LXC unprivileged nested=1 vs lxc.apparmor.profile unconfined what is more unsecure

[kuumaur]

Hi,
I run all my LXC container unprivileged.
Now and then I have issues with systemd and/or logrotate and some more services not starting.
I resolve the issues with lxc.apparmor.profile unconfined in the LXC conf file.
But I could resolve it by setting nested=1 option in LXC conf file.

So, what is more secure?
What does expose more risk?

Thanx for an explanation.

 

[fiona]

Hi,
AFAIK, nesting is much more limited, in that it exposes procfs and sysfs of the host to the guest. Note that the web UI defaults to enabling nesting, because it is required for most modern containers. The backend uses lxc.apparmor.allow_nesting = 1 when the feature is enabled.