Public bug reported:
Ubuntu 26.04.1 LTS
Kernel: 7.0.0-38-generic
AppArmor: 5.0.2-0ubuntu1~26.04.1
Docker: 29.1.3
containerd: 2.2.2
runc: 1.4.0-0ubuntu1
root@ubuntuiohyve161:/etc/docker/compose/arcane-agent# sudo journalctl -k
--since "2026-10-26 03:54:00" \
--until "2026-10-26 03:55:00" \
--no-pager \
| grep 'apparmor="DENIED"'
Oct 26 03:54:30 ubuntuiohyve161 kernel: audit: type=1400
audit(1793004870.636:554): apparmor="DENIED" operation="signal" class="signal"
profile="docker-default" pid=918122 comm="runc" requested_mask="receive"
denied_mask="receive" signal=term peer="runc"
Oct 26 03:54:32 ubuntuiohyve161 kernel: audit: type=1400
audit(1793004872.759:555): apparmor="DENIED" operation="signal" class="signal"
profile="docker-default" pid=918134 comm="runc" requested_mask="receive"
denied_mask="receive" signal=kill peer="runc"
Running arcane in docker container. Apparmor prevents shutdown runc
Not sure but I think default policy of runc should be unconfined but it
doesn't seem to work:
root@ubuntuiohyve161:/etc/docker/compose/arcane-agent# sudo cat
/etc/apparmor.d/runc
# This profile allows everything and only exists to give the
# application a name instead of having the label "unconfined"
abi <abi/5.0>,
include <tunables/global>
profile runc /usr/{bin,sbin}/runc flags=(unconfined) {
userns,
@{exec_path} mr,
# Site-specific additions and overrides. See local/README for details.
include if exists <local/runc>
}
Workaround for me was to include within compose.yml file:
security_opt:
- apparmor=unconfined
ProblemType: Bug
DistroRelease: Ubuntu 26.04
Package: apparmor 5.0.2-0ubuntu1~26.04.1
ProcVersionSignature: Ubuntu 7.0.0-38.38-generic 7.0.14
Uname: Linux 7.0.0-38-generic x86_64
ApportVersion: 2.34.1-0ubuntu0.1
Architecture: amd64
CasperMD5CheckResult: unknown
Date: Mon Oct 26 04:06:30 2026
InstallationDate: Installed on 2017-01-08 (3578 days ago)
InstallationMedia: Ubuntu-Server 16.04.1 LTS "Xenial Xerus" - Release amd64
(20160719)
ProcEnviron:
LANG=en_US.UTF-8
PATH=(custom, no user)
SHELL=/bin/bash
TERM=xterm-256color
ProcKernelCmdline: BOOT_IMAGE=/boot/vmlinuz-7.0.0-38-generic
root=UUID=59143dcc-962b-4628-93ff-6a1536e68fbd ro ipv6.disable=1
SourcePackage: apparmor
Syslog: 2026-10-25T20:24:49.433798-05:00 ubuntu-iohyve-161 dbus-daemon[678704]:
[session uid=1000 pid=678704 pidfd=5] AppArmor D-Bus mediation is enabled
UpgradeStatus: Upgraded to resolute on 2026-08-28 (58 days ago)
** Affects: apparmor (Ubuntu)
Importance: Undecided
Status: New
** Tags: amd64 apport-bug resolute
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2172213
Title:
AppArmor docker-default denies SIGTERM/SIGKILL from runc on Ubuntu
26.04, preventing Docker containers from stopping gracefully
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/apparmor/+bug/2172213/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
