Public bug reported:
System
Ubuntu 24.04.4 LTS
Kernel: 7.0.0-28-generic
docker.io 29.1.3-0ubuntu3~24.04.2
AppArmor enabled
Expected behaviour
The following command should succeed:
docker run --rm \
--cap-add SYS_ADMIN \
almalinux:9 \
sh -c 'mkdir -p /tmp/test && mount -t tmpfs tmpfs /tmp/test && echo SUCCESS'
Actual behaviour
The command fails with:
mount: /tmp/test: cannot mount tmpfs read-only.
If AppArmor is disabled for the container:
docker run --rm \
--security-opt apparmor=unconfined \
--cap-add SYS_ADMIN \
almalinux:9 \
sh -c 'mkdir -p /tmp/test && mount -t tmpfs tmpfs /tmp/test && echo SUCCESS'
the command succeeds and prints:
SUCCESS
Additional information
The active AppArmor profile is:
docker-default (enforce)
This issue was discovered while investigating failures of LHC@home
Theory tasks, but the reproducer above demonstrates that the problem
exists independently of BOINC.
I would also mention that:
docker run alpine cat /proc/self/attr/current
returns
docker-default (enforce)
ProblemType: Bug
DistroRelease: Ubuntu 24.04
Package: docker.io 29.1.3-0ubuntu3~24.04.2
ProcVersionSignature: Ubuntu 7.0.0-28.28~24.04.1-generic 7.0.12
Uname: Linux 7.0.0-28-generic x86_64
ApportVersion: 2.28.2-0ubuntu0.1
Architecture: amd64
CasperMD5CheckResult: pass
CurrentDesktop: ubuntu:GNOME
Date: Sun Aug 2 09:47:43 2026
InstallationDate: Installed on 2026-04-22 (102 days ago)
InstallationMedia: Ubuntu 24.04.4 LTS "Noble Numbat" - Release amd64 (20260210)
ProcEnviron:
LANG=fr_FR.UTF-8
PATH=(custom, no user)
SHELL=/bin/bash
TERM=xterm-256color
XDG_RUNTIME_DIR=<set>
SourcePackage: docker.io-app
UpgradeStatus: No upgrade log present (probably fresh install)
** Affects: docker.io-app (Ubuntu)
Importance: Undecided
Status: New
** Tags: amd64 apport-bug noble wayland-session
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2162651
Title:
The AppArmor profile generated by docker.io 29.1.3 prevents tmpfs
mounts inside containers, even when the container has CAP_SYS_ADMIN.
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/docker.io-app/+bug/2162651/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
