From ac0d0da07170a584d0ec79d23364368f79c39b14 Mon Sep 17 00:00:00 2001
From: npeter83 <npeter83+claude@gmail.com>
Date: Thu, 11 Jun 2026 16:42:44 +0200
Subject: [PATCH] fix(deploy): apparmor:unconfined for Docker-in-LXC

The docker-default AppArmor profile can't be loaded from inside the LXC; match the
lab convention (finance/arr stacks) of running services unconfined.
---
 docker-compose.localdev.yml | 3 +++
 docker-compose.server.yml   | 6 ++++++
 2 files changed, 9 insertions(+)

diff --git a/docker-compose.localdev.yml b/docker-compose.localdev.yml
index 5f1017d..fbd0bf3 100644
--- a/docker-compose.localdev.yml
+++ b/docker-compose.localdev.yml
@@ -25,6 +25,9 @@ services:
     environment:
       # Exactly one scheduler may write to the shared DB; the server owns it.
       SCHEDULER_ENABLED: "false"
+    # Harmless on Docker Desktop; needed if ever run under Docker-in-LXC.
+    security_opt:
+      - apparmor:unconfined
     ports:
       - "${APP_PORT:-8080}:8000"
     restart: unless-stopped
diff --git a/docker-compose.server.yml b/docker-compose.server.yml
index 279468b..49ee062 100644
--- a/docker-compose.server.yml
+++ b/docker-compose.server.yml
@@ -26,6 +26,10 @@ services:
     ports:
       # Published on the LAN so the local dev webapp uses this central DB.
       - "5432:5432"
+    # Required for Docker-in-LXC: the container can't load the docker-default
+    # AppArmor profile inside an unprivileged-from-AppArmor's-view namespace.
+    security_opt:
+      - apparmor:unconfined
     healthcheck:
       test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-subfeed} -d ${POSTGRES_DB:-subfeed}"]
       interval: 5s
@@ -45,6 +49,8 @@ services:
     depends_on:
       db:
         condition: service_healthy
+    security_opt:
+      - apparmor:unconfined
     ports:
       # Exposed on the LAN for status/health checks only. Interactive Google login
       # needs a public HTTPS redirect URL (set up later); backfill runs regardless.