From 65c75d8f05bc49ffd9b2bf456a07967258c99e9a Mon Sep 17 00:00:00 2001
From: npeter83 <npeter83+claude@gmail.com>
Date: Thu, 11 Jun 2026 16:42:44 +0200
Subject: [PATCH] fix(deploy): apparmor:unconfined for nested Docker

The docker-default AppArmor profile can't be loaded from inside the container; match the
lab convention (finance/arr stacks) of running services unconfined.
---
 docker-compose.localdev.yml | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/docker-compose.localdev.yml b/docker-compose.localdev.yml
index 918b21e..69b3dd3 100644
--- a/docker-compose.localdev.yml
+++ b/docker-compose.localdev.yml
@@ -25,6 +25,9 @@ services:
     environment:
       # Exactly one scheduler may write to the shared DB; the server owns it.
       SCHEDULER_ENABLED: "false"
+    # Harmless on Docker Desktop; needed if ever run under Docker-in-LXC.
+    security_opt:
+      - apparmor:unconfined
     ports:
       - "${APP_PORT:-8080}:8000"
     restart: unless-stopped