diff --git a/docker-compose.localdev.yml b/docker-compose.localdev.yml
index 918b21e..69b3dd3 100644
--- a/docker-compose.localdev.yml
+++ b/docker-compose.localdev.yml
@@ -25,6 +25,9 @@ services:
     environment:
       # Exactly one scheduler may write to the shared DB; the server owns it.
       SCHEDULER_ENABLED: "false"
+    # Harmless on Docker Desktop; needed if ever run under Docker-in-LXC.
+    security_opt:
+      - apparmor:unconfined
     ports:
       - "${APP_PORT:-8080}:8000"
     restart: unless-stopped