Risks of using unconfined


Renowned Member
Hi guys

What are the risks of making the following a global setting. We host VPS servers ranging from Ubuntu, Debian but mainly cPanel and CentOS servers.

CPanel requires the following :

lxc.aa_profile = unconfined

in each conf file. We dont want to do this manually each time so considering doing it:




Any risks in doing this?
lxc.aa_profile = unconfined

I think it should be "lxc.apparmor.profile = unconfined".

When you use AppArmor in "unconfined", then it means you forgo any protection provided by it. That means, your containers won't be protected against internal/external threats. In the end, it's a risk-reward decision you have to make. You can disable it if you can't use AppArmor in your setup because of unsupported software, but it's good to be aware of the risks when doing that.


The Proxmox community has been around for many years and offers help and support for Proxmox VE, Proxmox Backup Server, and Proxmox Mail Gateway.
We think our community is one of the best thanks to people like you!

Get your subscription!

The Proxmox team works very hard to make sure you are running the best software and getting stable updates and security enhancements, as well as quick enterprise support. Tens of thousands of happy customers have a Proxmox subscription. Get yours easily in our online shop.

Buy now!