{"action":"created","issue":{"url":"https://api.github.com/repos/opencontainers/runc/issues/483","repository_url":"https://api.github.com/repos/opencontainers/runc","labels_url":"https://api.github.com/repos/opencontainers/runc/issues/483/labels{/name}","comments_url":"https://api.github.com/repos/opencontainers/runc/issues/483/comments","events_url":"https://api.github.com/repos/opencontainers/runc/issues/483/events","html_url":"https://github.com/opencontainers/runc/issues/483","id":127077873,"number":483,"title":"AppArmor issue with libcontainer on LXC privilege container","user":{"login":"kimh","id":924390,"avatar_url":"https://avatars.githubusercontent.com/u/924390?v=3","gravatar_id":"","url":"https://api.github.com/users/kimh","html_url":"https://github.com/kimh","followers_url":"https://api.github.com/users/kimh/followers","following_url":"https://api.github.com/users/kimh/following{/other_user}","gists_url":"https://api.github.com/users/kimh/gists{/gist_id}","starred_url":"https://api.github.com/users/kimh/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kimh/subscriptions","organizations_url":"https://api.github.com/users/kimh/orgs","repos_url":"https://api.github.com/users/kimh/repos","events_url":"https://api.github.com/users/kimh/events{/privacy}","received_events_url":"https://api.github.com/users/kimh/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":2,"created_at":"2016-01-17T06:34:14Z","updated_at":"2016-02-10T22:55:41Z","closed_at":"2016-02-10T22:55:41Z","body":"Related with https://github.com/opencontainers/runc/issues/464, I'm trying to use libcontainer on priv LXC  container. More specifically, I'm trying to run https://github.com/kimh/libcontainer-example on priv LXC container.\r\n\r\nI'm encountering several issues but right now I'm blocked by one error and I run out of ideas how to debug further.\r\n\r\nHere is the error I'm getting now.\r\n\r\n```\r\n$ ROOTFS=$(pwd)/rootfs go run main.go\r\nWARN[0000] signal: killed\r\n[9] System error: could not synchronise with container process\r\nexec: Wait was already called\r\nsignal: killed\r\ndone\r\n```\r\n\r\nThis works if I disable `lxc-container-default` AppArmor profile on LXC host machine. It also works if I add `lxc.aa_profile = unconfined` to the LXC config of the container. So, apparently the issue is something to do with AppArmor.\r\n\r\nHowever, I don't get any audit logs from AppArmor while getting the error. From the error, I know I'm hitting https://github.com/opencontainers/runc/blob/master/libcontainer/process_linux.go#L262 but I'm not sure how it's related to AppArmor.\r\n\r\nCould anyone give me a pointer to how I can investigate further?\r\n\r\nHere is [config.json](https://github.com/kimh/libcontainer-example/blob/master/config.json).\r\nHere is [main.go](https://github.com/kimh/libcontainer-example/blob/master/main.go)."},"comment":{"url":"https://api.github.com/repos/opencontainers/runc/issues/comments/182620314","html_url":"https://github.com/opencontainers/runc/issues/483#issuecomment-182620314","issue_url":"https://api.github.com/repos/opencontainers/runc/issues/483","id":182620314,"user":{"login":"crosbymichael","id":749551,"avatar_url":"https://avatars.githubusercontent.com/u/749551?v=3","gravatar_id":"","url":"https://api.github.com/users/crosbymichael","html_url":"https://github.com/crosbymichael","followers_url":"https://api.github.com/users/crosbymichael/followers","following_url":"https://api.github.com/users/crosbymichael/following{/other_user}","gists_url":"https://api.github.com/users/crosbymichael/gists{/gist_id}","starred_url":"https://api.github.com/users/crosbymichael/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/crosbymichael/subscriptions","organizations_url":"https://api.github.com/users/crosbymichael/orgs","repos_url":"https://api.github.com/users/crosbymichael/repos","events_url":"https://api.github.com/users/crosbymichael/events{/privacy}","received_events_url":"https://api.github.com/users/crosbymichael/received_events","type":"User","site_admin":false},"created_at":"2016-02-10T22:55:41Z","updated_at":"2016-02-10T22:55:41Z","body":"It is possible but you are going to have to give it all capabilities, no device restrictions, and mess with the settings alot to see what works.  Also you need the container to be unconfined.  Closing as this really is not any issue for runc but how you are configuring your outside containers. "}}