But Debian 10 loads AppArmor profiles fine when run as a VM (under KVM, VMware etc) or on bare metal. This problem only happens when Debian 10 runs under LXD.
By the way, I had enabled security.nesting for CT vm05, because it was needed in order to run MariaDB 10.4 under Debian 10.