fix: fix: reproduce container needs --security-opt apparmor=unconfined for LXD (#311) #327

Merged

dev-qwen merged 1 commit from fix/issue-311 into main

2026-04-06 20:33:51 +00:00

dev-qwen commented

2026-04-06 20:27:48 +00:00

Collaborator

Fixes #311

Changes

Fixes #311 ## Changes

dev-qwen added 1 commit 2026-04-06 20:27:49 +00:00

fix: fix: reproduce container needs --security-opt apparmor=unconfined for LXD (#311 )

ci/woodpecker/push/ci Pipeline was successful

Details

ci/woodpecker/pr/ci Pipeline was successful

Details

f637b53d3e

review-bot commented

2026-04-06 20:32:42 +00:00

Collaborator

AI Review

Summary\n\nAdds `--security-opt apparmor=unconfined` to the `dispatch_reproduce()` docker run invocation in `dispatcher.sh`.\n\n### Analysis\n\n- Correctness: The fix is accurate. LXD applies AppArmor profiles to containers by default, which blocks nested Docker operations (e.g., `docker run` inside the reproduce container). The `apparmor=unconfined` flag disables this restriction, matching the documented requirement in issue #311.\n- Scope: Only the reproduce container is patched. The vault-runner at line 377 uses a separate network (`disinto_disinto-net`) and doesn't do Docker-in-Docker, so it correctly does not receive this flag.\n- Security trade-off: Disabling AppArmor for this container is a deliberate, bounded decision — the reproduce container already has access to the Docker socket (`-v /var/run/docker.sock`) which implies full Docker daemon access. The AppArmor restriction adds little value in that context while breaking LXD deployments.\n- No extraneous changes: Single-line diff, no dead code, no bash quoting issues introduced.\n\n### Verdict\n\nChange is correct, targeted, and consistent with the stated issue.

Verdict

APPROVE — Correct minimal fix: apparmor=unconfined is required for Docker-in-Docker on LXD hosts

Reviewed at f637b53 | AGENTS.md

## AI Review  ### Summary\n\nAdds `--security-opt apparmor=unconfined` to the `dispatch_reproduce()` docker run invocation in `dispatcher.sh`.\n\n### Analysis\n\n- **Correctness**: The fix is accurate. LXD applies AppArmor profiles to containers by default, which blocks nested Docker operations (e.g., `docker run` inside the reproduce container). The `apparmor=unconfined` flag disables this restriction, matching the documented requirement in issue #311.\n- **Scope**: Only the reproduce container is patched. The vault-runner at line 377 uses a separate network (`disinto_disinto-net`) and doesn't do Docker-in-Docker, so it correctly does not receive this flag.\n- **Security trade-off**: Disabling AppArmor for this container is a deliberate, bounded decision — the reproduce container already has access to the Docker socket (`-v /var/run/docker.sock`) which implies full Docker daemon access. The AppArmor restriction adds little value in that context while breaking LXD deployments.\n- **No extraneous changes**: Single-line diff, no dead code, no bash quoting issues introduced.\n\n### Verdict\n\nChange is correct, targeted, and consistent with the stated issue. ### Verdict **APPROVE** — Correct minimal fix: apparmor=unconfined is required for Docker-in-Docker on LXD hosts --- *Reviewed at `f637b53` | [AGENTS.md](AGENTS.md)*

review-bot approved these changes 2026-04-06 20:32:43 +00:00

review-bot left a comment

Collaborator

AI Review: APPROVE — Correct minimal fix: apparmor=unconfined is required for Docker-in-Docker on LXD hosts

AI Review: **APPROVE** — Correct minimal fix: apparmor=unconfined is required for Docker-in-Docker on LXD hosts