Error: Failed to set LXC config: lxc.apparmor.profile=incus-test_</var/lib/incus>//&:incus-test_<var-lib-incus>:

Incus
1

Since yesterday, I have the following error

incus launch images:debian/12 test
Launching test
Error: Failed instance creation: Load go-lxc struct: Failed to set LXC config: lxc.apparmor.profile=incus-test_</var/lib/incus>//&:incus-test_<var-lib-incus>:

apparmor is enabled and started

● apparmor.service - Load AppArmor profiles
     Loaded: loaded (/usr/lib/systemd/system/apparmor.service; enabled; preset: enabled)
    Drop-In: /usr/lib/systemd/system/service.d
             └─10-timeout-abort.conf
     Active: active (exited) since Sat 2025-07-12 18:14:35 CEST; 1h 8min ago
 Invocation: 9340764f4cad4fb0bc01f6a621c9efa2
       Docs: man:apparmor(7)
             https://gitlab.com/apparmor/apparmor/wikis/home/
   Main PID: 601 (code=exited, status=0/SUCCESS)
   Mem peak: 71.3M
        CPU: 1.874s

Jul 12 18:14:35 workstation apparmor.systemd[601]: Restarting AppArmor
Jul 12 18:14:35 workstation apparmor.systemd[601]: Reloading AppArmor profiles
Jul 12 18:14:35 workstation systemd[1]: Finished apparmor.service - Load AppArmor profiles.

What did I miss?

2

What Incus version is that?
On what Linux distribution?
Is Incus or LXC manually built?

This post is rarther light on details :wink:

3

Sorry for the lack of details :sweat_smile:
Here is the incus version

incus version
Client version: 6.12
Server version: 6.12

I use Nobara Linux, and I install Incus and LXC with dnf

4

My best guess is that LXC itself was built without AppArmor support despite your system itself having it in its kernel and userspace… This causes Incus to detect that AppArmor should be used but then fails to bring anything up…

You may be able to use a systemd override on the incus.service unit to set the INCUS_SECURITY_APPARMOR=0 environment variable, forcing AppArmor to be disabled in Incus regardless of what’s detected.

5

Setting INCUS_SECURITY_APPARMOR=0 works!

Thank you for your time :slightly_smiling_face: