While downgrading runc below 1.2.7/1.3.2 would "fix" the issue, it exposes your system to actual privilege escalation vulnerabilities that the security update patched. The workaround in this repository is the recommended approach.

✅ The Solution

This repository provides tools that automatically apply and manage the AppArmor workaround for Proxmox LXC containers:

1. pve-script-wrapper.sh - Universal wrapper for Proxmox community scripts
2. pve-docker-fix - Fix existing containers that are already broken
3. pve-docker-rollback - Remove the workaround when upstream fixes are available
4. pct-patched - Internal wrapper (used automatically by pve-script-wrapper.sh)

How It Works

The scripts automatically detect your container's OS and apply the appropriate AppArmor workaround:

For all containers:

For Ubuntu containers only:

The first line disables AppArmor confinement (required for all distributions). The second line masks the AppArmor module detection and is only needed for Ubuntu containers - Debian containers typically work without it (runc#4968).

OS Auto-Detection: The scripts automatically detect whether your container is Ubuntu or Debian and apply only the necessary configuration lines.

📦 Installation

On your Proxmox VE host, run:

Or clone the repository:

🚀 Usage

Running Community Scripts with Automatic Fix

Instead of:

Use:

This works with any Proxmox community script that creates LXC containers:

Fixing Existing Containers

If you already have a broken container:

The tool will:

1. Check if the fix is already applied
2. Stop the container (with confirmation)
3. Apply the AppArmor workaround
4. Restart the container

Manual Fix

If you prefer to apply the fix manually:

Note: Debian containers typically only need the first line. Ubuntu containers need both lines. See runc#4968 for technical details.

Rolling Back the Fix

When upstream fixes are available (Proxmox/LXC/AppArmor updates), you can remove the workaround:

The rollback tool will:

1. Detect if the workaround is applied
2. Show which lines will be removed
3. Request confirmation (unless --force)
4. Remove the AppArmor configuration
5. Restart the container if needed

When to rollback:

• Wait for announcements that upstream fixes are available
• Monitor runc#4968 for updates
• Test on non-critical containers first
• Verify Docker/containers work after rollback before removing from production

🔧 How It Works Technically

pve-script-wrapper.sh

• Creates a temporary directory with a symlink to pct-patched
• Modifies PATH to prioritize the wrapper
• Downloads and executes the community script
• The script transparently uses the patched pct command

pct-patched

• Intercepts pct create commands
• Calls the real /usr/sbin/pct to create the container
• Detects container OS type (Ubuntu vs Debian)
• Immediately after creation, injects appropriate AppArmor configuration into /etc/pve/lxc/$CTID.conf
• Passes through all other pct commands unchanged

pve-docker-fix

• Standalone tool for fixing existing containers
• Detects container OS type automatically
• Checks if fix is already applied (idempotent)
• Applies only necessary configuration lines based on OS
• Handles container stop/start with user confirmation
• Safe to run multiple times

pve-docker-rollback

• Removes the AppArmor workaround when no longer needed
• Scans all containers to find those with workaround applied
• Safely removes comment blocks and configuration lines
• Supports single container, batch (--all), or list mode
• Dry-run mode to preview changes before applying
• Handles container restart with confirmation
• Idempotent and safe to run multiple times

🛡️ Security Considerations

What This Changes

• Disables AppArmor confinement for the LXC container
• Removes one layer of defense-in-depth

What's Still Protected

• Container is still unprivileged (most important security boundary)
• Kernel namespaces still enforce isolation
• cgroups resource limits still apply
• Standard Linux permissions still active

Risk Assessment

• Risk: Slightly reduced isolation if container is compromised
• Mitigation: Containers remain unprivileged, which is the primary security control
• Comparison: Much safer than downgrading runc and exposing actual CVEs

When NOT to Use This

• Production environments requiring maximum isolation
• Multi-tenant systems with untrusted containers
• Containers running untrusted code

Alternatives

• Wait for upstream fixes (Proxmox/LXC/AppArmor/kernel)
• Use privileged containers (NOT recommended - worse security)
• Use VMs instead of containers (more overhead)

📋 Affected Systems

Confirmed Affected

• Proxmox VE 8.x with recent updates
• Debian 12 (Bookworm) LXC containers
• Ubuntu LXC containers (all recent versions)
• runc versions 1.2.7+ and 1.3.2+
• containerd version 1.7.28-2+

OS-Specific Notes

• Debian containers: Typically only need lxc.apparmor.profile: unconfined
• Ubuntu containers: Need both config lines (profile + mount entry)
• Scripts auto-detect OS and apply appropriate fix

Community Scripts Known to Be Affected

• docker.sh
• komodo.sh
• dockge.sh
• casaos.sh
• podman.sh
• runtipi.sh
• omv.sh (OpenMediaVault)
• alpine-docker.sh
• podman-homeassistant.sh
• And 390+ other container-based scripts

🔗 References

• Primary Issue: opencontainers/runc#4968
• CVE: CVE-2025-52881
• Related CVEs: CVE-2025-31133, CVE-2025-52565
• Proxmox Forum Discussion: Community Scripts Issue #8890
• Incus Fix: PR #2624

🐛 Troubleshooting

Script doesn't work

Docker still fails after applying fix

Container won't start after fix

🤝 Contributing

Contributions welcome! Please:

1. Test your changes on a Proxmox VE system
2. Update documentation if adding features
3. Follow existing code style
4. Submit a PR with clear description

📝 License

GNU GENERAL PUBLIC LICENSE - See LICENSE file for details

🙏 Acknowledgments

• opencontainers/runc team for the security fixes
• community-scripts/ProxmoxVE maintainers
• All contributors to the issue discussions

⚡ Quick Reference

Note: This is a temporary workaround until upstream projects release permanent fixes. Monitor the referenced GitHub issues for updates.