Network doesn't work w/o `lxc.apparmor.profile = unconfined` in unprivileged containers

[tomp (Thomas Parrott)]

See:

Problem with disable apparmor for single container

lxc.apparmor.profile=unconfined makes your container run without apparmor confinement, that doesn’t however mean that profiles cannot be loaded and used by it nor that existing apparmor profiles on the host cannot apply to it. That’s why that option is so terrible, it effectively allows the host to mess with apparmor profiles on the host and any host apparmor profile to randomly apply to container processes.

and:

Problem with disable apparmor for single container

You should stay away from the lxc.apparmor.profile=unconfined and instead use raw.apparmor to allow anything which gets blocked by the stock profile.