I'm able to reproduce this locally.
> This appears to be an interaction between docker-default AppArmor
confinement and Ubuntu 24.04 HWE kernel 7.0.
I don't think this is related to the HWE kernel at all. See:
root@docker-noble:~# uname -a
Linux docker-noble 6.8.0-136-generic #136-Ubuntu SMP PREEMPT_DYNAMIC Wed Jul 1
21:53:05 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux
root@docker-noble:~# docker run --rm --cap-add SYS_ADMIN almalinux:9 sh
-c 'mkdir -p /tmp/test && mount -t tmpfs tmpfs /tmp/test && echo SUCCESS'
mount: /tmp/test: cannot mount tmpfs read-only.
Even with that knowledge, I'm not 100% sure that this is really a bug. I
believe that this is expected behavior from Docker's default AppArmor
profile rather than a Docker or kernel bug. Even with SYS_ADMIN,
AppArmor is an additional (and independent) restriction.
If the goal here is to simply provide a tmpfs-backed directory to the
container, use --mount instead:
root@docker-noble:~# docker run --rm \
--mount type=tmpfs,dst=/tmp/test \
almalinux:9 \
sh -c 'mount | grep /tmp/test && echo SUCCESS'
tmpfs on /tmp/test type tmpfs (rw,nosuid,nodev,noexec,relatime,inode64)
SUCCESS
I'm marking this as invalid, but feel free to reopen if you do not
agree.
** Changed in: docker.io-app (Ubuntu)
Status: New => Invalid
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2162651
Title:
The AppArmor profile generated by docker.io 29.1.3 prevents tmpfs
mounts inside containers, even when the container has CAP_SYS_ADMIN.
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/docker.io-app/+bug/2162651/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
