I performed additional investigation after my previous comments. I reproduced the same behavior with:
Ubuntu docker.io Docker CE (official packages) Although the AppArmor profile loaded by Docker CE differs from Ubuntu's (different compiled profile hash), both profiles behave identically: docker-default (enforce) denies mount(2) even with CAP_SYS_ADMIN --security-opt apparmor=unconfined immediately allows the mount seccomp=unconfined has no effect I also verified that a minimal custom AppArmor profile without any mount rules behaves the same way, which indicates that AppArmor denies mount() by default for confined profiles unless mount permissions are explicitly granted. Based on these results, I agree that this does not appear to be specific to Ubuntu's docker.io package. -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2162651 Title: The AppArmor profile generated by docker.io 29.1.3 prevents tmpfs mounts inside containers, even when the container has CAP_SYS_ADMIN. To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/docker.io-app/+bug/2162651/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
