title: mounting permission denied in docker
body: <p>I was facing issues installing docker on cloud server according to the official guide(<a href="https://docs.docker.com/engine/install/ubuntu/" rel="nofollow noreferrer">Install Docker Engine on Ubuntu</a>). I finished old version's uninstallation, the repository setting up and docker engine installation (sudo apt-get install docker-ce docker-ce-cli containerd.io). However, I got an error when running hello-world.</p>
  <pre><code>wyf@VM1103-Timi:~$ sudo docker run hello-world
  docker: Error response from daemon: OCI runtime create failed: container_linux.go:349: starting container process caused &quot;process_linux.go:449: container init caused \&quot;rootfs_linux.go:58: mounting \\\&quot;proc\\\&quot; to rootfs \\\&quot;/var/lib/docker/overlay2/e9fedf64e8983aa01e513cee591cdfd7fc60962466a476b51fc1ead682ec8022/merged\\\&quot; at \\\&quot;/proc\\\&quot; caused \\\&quot;permission denied\\\&quot;\&quot;&quot;: unknown.
  ERRO[0000] error waiting for container: context canceled
  </code></pre>
  <p>I tried restart docker and server, but the problem still exists.
  So, it would be great if someone can guide me in fixing this error.
  Please let me know if you have any idea about this issue.
  Thank you very much!</p>
  <p>Ps:
  My system is Ubuntu 18.04. Thus, I did not have selinux. Instead of selinux, I checked AppArmor log.</p>
  <pre><code>May 19 21:14:55 VM1103-Timi networkd-dispatcher[155]: WARNING:Unknown index 37 seen, reloading interface list
  May 19 21:14:55 VM1103-Timi systemd-networkd[126]: veth71cf495: Link UP
  May 19 21:14:55 VM1103-Timi containerd[170]: time=&quot;2020-05-19T21:14:55.679793295+08:00&quot; level=info msg=&quot;shim containerd-shim started&quot; address=&quot;/containerd-shim/moby/4c207ce1273d2c863ee419c5ebb271163a031394bd4c17ee75d44267d631954d/shim.sock&quot; debug=false pid=106265
  May 19 21:14:55 VM1103-Timi containerd[170]: time=&quot;2020-05-19T21:14:55.767796543+08:00&quot; level=info msg=&quot;shim reaped&quot; id=4c207ce1273d2c863ee419c5ebb271163a031394bd4c17ee75d44267d631954d
  May 19 21:14:55 VM1103-Timi dockerd[15100]: time=&quot;2020-05-19T21:14:55.776863367+08:00&quot; level=error msg=&quot;stream copy error: reading from a closed fifo&quot;
  May 19 21:14:55 VM1103-Timi dockerd[15100]: time=&quot;2020-05-19T21:14:55.776953910+08:00&quot; level=error msg=&quot;stream copy error: reading from a closed fifo&quot;
  May 19 21:14:55 VM1103-Timi systemd-networkd[126]: veth71cf495: Link DOWN
  May 19 21:14:55 VM1103-Timi dockerd[15100]: time=&quot;2020-05-19T21:14:55.927805156+08:00&quot; level=error msg=&quot;4c207ce1273d2c863ee419c5ebb271163a031394bd4c17ee75d44267d631954d cleanup: failed to delete container from containerd: no such container&quot;
  </code></pre>
  <p>The strange thing is that there is no record of permission-denied error.</p>
  <p>Here are my ubuntu version, kernal version and docker info:</p>
  <pre><code>No LSB modules are available.
  Distributor ID: Ubuntu
  Description:    Ubuntu 18.04.4 LTS
  Release:        18.04
  Codename:       bionic
  </code></pre>
  <pre><code>5.3.18-3-pve
  </code></pre>
  <pre><code>Client:
   Debug Mode: false
  Server:
   Containers: 8
    Running: 0
    Paused: 0
    Stopped: 8
   Images: 1
   Server Version: 19.03.8
   Storage Driver: overlay2
    Backing Filesystem: &lt;unknown&gt;
    Supports d_type: true
    Native Overlay Diff: false
   Logging Driver: json-file
   Cgroup Driver: cgroupfs
   Plugins:
    Volume: local
    Network: bridge host ipvlan macvlan null overlay
    Log: awslogs fluentd gcplogs gelf journald json-file local logentries splunk syslog
   Swarm: inactive
   Runtimes: runc
   Default Runtime: runc
   Init Binary: docker-init
   containerd version: 7ad184331fa3e55e52b890ea95e65ba581ae3429
   runc version: dc9208a3303feef5b3839f4323d9beb36df0a9dd
   init version: fec3683
   Security Options:
    apparmor
    seccomp
     Profile: default
   Kernel Version: 5.3.18-3-pve
   Operating System: Ubuntu 18.04.4 LTS
   OSType: linux
   Architecture: x86_64
   CPUs: 2
   Total Memory: 4GiB
   Name: VM1103-Timi
   ID: 3G3F:LTVZ:NO25:C7LA:XKQV:ETMB:B6QU:3ZFJ:KBA5:R3KK:QZEA:ZONC
   Docker Root Dir: /var/lib/docker
   Debug Mode: false
   Registry: https://index.docker.io/v1/
   Labels:
   Experimental: false
   Insecure Registries:
    127.0.0.0/8
   Live Restore Enabled: false
  </code></pre>
  <p>It seemed that the AppArmor Profile &quot;docker-default&quot; was lost. &quot;docker-default&quot; was not correctly generated. Check as follows:</p>
  <pre><code>root@VM1103-Timi:/etc/apparmor.d# aa-status
      apparmor module is loaded.
      12 profiles are loaded.
      12 profiles are in enforce mode.
         /sbin/dhclient
         /usr/bin/man
         /usr/lib/NetworkManager/nm-dhcp-client.action
         /usr/lib/NetworkManager/nm-dhcp-helper
         /usr/lib/connman/scripts/dhclient-script
         /usr/lib/lightdm/lightdm-guest-session
         /usr/lib/lightdm/lightdm-guest-session//chromium
         /usr/sbin/mysqld
         /usr/sbin/tcpdump
         docker-default
         man_filter
         man_groff
      0 profiles are in complain mode.
      1 processes have profiles defined.
      1 processes are in enforce mode.
         /usr/sbin/mysqld (258)
      0 processes are in complain mode.
      0 processes are unconfined but have a profile defined.
  </code></pre>