I installed 26.04 on one of my Incus hosts yesterday. In some LXC instances (running 24.04.4) I’m seeing a problem I remember we saw with earlier Ubuntu releases, where apt update hangs even though other networking works fine. If the instance is privileged, then apt works. This was related to AppAr…

I’ve done a lot more digging. The root cause seems to be that from 25.04 onwards Canonical has been enforcing AppArmor Profile Stacking (/sys/kernel/security/apparmor/features/domain/stack = yes) so we see other things breaking elsewhere too (eg AppArmor: signal rule does not match stacked profile …

[image] hereisjames: This was related to AppArmor I believe? That could be, yes. AppArmor is a powerfull Armor and bug creator :slight_smile: Seems it’s easy to disable apparmor (on the host): https://linuxconfig.org/how-to-disable-apparmor-on-ubuntu-26-04 For sure you can check dmsg / jou…

Also like previous issues, eventually all your RAM is consumed because parent processes in the instances can’t kill their children and the server becomes unresponsive. When I get a chance (two week old baby!) I’ll see what’s in the logs.

I get basically a continuous repeat of these two AppArmor issues for every instance : Apr 24 18:49:09 librarian kernel: audit: type=1400 audit(1777052949.453:61435): apparmor=“DENIED” operation=“ptrace” class=“ptrace” profile=“incus-media_</var/lib/incus>” pid=4565 comm=“systemd-journal” requested_…

Did you try to disable apparmor - sudo aa-teardown; sudo aa-status. as you suspected apparmor seems the problem. If you see incus working as is after that you might wanna add/modify the lxd/incus profile - I would need to have the create the same setup to give correct instructions.

Seems very similar to the issues we had with Noble, so I’d guess the fix is the same : [image] AppArmor blocks sending signals on Ubuntu 25.04 host Incus Symptoms and Preliminary Investigation On an Ubuntu 25.04 host running Incus 6.13 from Zabbly repo I creat…

Exasperating that the problem repeated across two distro upgrades. Perhaps no-one at Canonical runs test a system with LXD on it, since I’d assume the same issues would apply. :slight_smile:

Yeah apt update works again with aa off.

But … I have one instance whose only NIC is on a different VLAN and that will not compete Netplan apply. The instance NIC has a static IPv4 address in Netplan, but instead the NIC tries to get a dhcp6 address. If I try to netplan apply the command hangs until I ctrl-C and nothing appears in the log…

Try to boot without the apparmor service at all. When enabling apparmor again make sure you do it the right order or you get lot’s of troubles (on my Arch WS kernel apparmor without service apparmor = blackscreen) If your plesk container works w/o apparmor on the host you might transfer apparmor pr…

Easier is to follow the fix in the post I linked : ❯ incus profile create apparmor_fix Profile apparmor_fix created ❯ incus profile set apparmor_fix raw.apparmor=“signal peer=@{profile_name}//&unconfined,” ❯ incus profile add problem_instance apparmor_fix Profile apparmor_fix added to problem_i…

Issues in Ubuntu 26.04 - apt not working in unprivileged LXCs

Incus

hereisjames (James) April 24, 2026, 6:00pm 6

Seems very similar to the issues we had with Noble, so I’d guess the fix is the same :

Netplan apply hangs in Ubuntu 26.04 LXC (Incus/macvlan), works in 24.04