Bind9 (named) won't start inside a Debian 9 CT, no IPv4/6 interfaces found (solution: was due to enabling AppArmor)

Here are the differences between two identical CTs, one that has problem with Bind9 (vm01) another that runs fine (vm02). Both vm01 and vm02 are running Debian 9, on vm01 I installed Virtualmin/Webmin whereas on vm02 ISPconfig.

$ lxc config show vm01 --expanded > /tmp/vm01.txt
$ lxc config show vm02 --expanded > /tmp/vm02.txt
$ diff /tmp/vm01.txt /tmp/vm02.txt
4c4
<   image.description: Debian stretch amd64 (20200121_09:09)
---
>   image.description: Debian stretch amd64 (20191019_05:24)
7,9c7,9
<   image.serial: "20200121_09:09"
<   volatile.base_image: 594467907e3a5583689e8d9e867eebbc74037561526ab5fe46cfc989989de893
<   volatile.eth0.hwaddr: 00:16:3e:22:33:11
---
>   image.serial: "20191019_05:24"
>   volatile.base_image: 60def082b85d4d5bf60e76a1d9f9640b378a35028a2cb3af6f57e852df4ff866
>   volatile.eth0.hwaddr: 00:16:3e:22:33:12
$