Podman LXC with Ubuntu (instead of Debian)

[rzech]

Hello,

the Podman LXC script works great on Proxmox 8.3.4 with default OS selected (Debain 12). When I use Advanced Setup and change the OS to Ubuntu 24.04 the script fails when trying to install Portainer:

Trying to pull docker.io/portainer/portainer-ce:latest...
WARN[0000] "/run/user/0" directory set by $XDG_RUNTIME_DIR does not exist. Either create the directory or unset $XDG_RUNTIME_DIR.: stat /run/user/0: no such file or directory: Trying to pull image in the event that it is a public image.
Error: initializing source docker://portainer/portainer-ce:latest: pinging container registry registry-1.docker.io: Get "https://registry-1.docker.io/v2/": dial tcp: lookup registry-1.docker.io on ...:53: dial udp ...:53: socket: permission denied

On proxmox host i see the following in the logs:

audit[3113]: AVC apparmor="DENIED" operation="create" class="net" namespace="root//lxc-207_<-var-lib-lxc>" profile="podman" pid=3113 comm="podman" family="inet" sock_type="dgram" protocol=0 requested="create" denied="create"

When I disable apparmor for the container in proxmox (lxc.apparmor.profile: unconfined) I can run any container just fine in podman the Ubuntu LXC.

As Ubuntu is relying on Debian I was a bit surprise that the script is working on one but failing on the other system.
I'm not that deep into lxc, apparmor and podman and was now wondering if someone experienced this behaviour as well and if there is a way to get the script working on Ubuntu without the need of disabling apparmor.

Thanks in advance.

[rzech]

I think I found the difference between Debian and Ubuntu lxc:

A Proxmox container running the Debian template does not have apparmor service enabled whereas in the Ubuntu template apparmor is active. If I stop and disable apparmor service in the Ubuntu service podman seems to be working as expected. I also found that it is necessary to configure an overlay filesystem for zfs on Debain (like the script does) whereas this is not necessary on Ubuntu.