mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 10:59:59 +00:00
kevinveenbirkenbachandClaude Opus 5.5
a6c3c1cc91
`security-apparmor-teardown` ran `aa-teardown`, which unloads every profile including dockerd's in-memory `docker-default`. dockerd only loads that profile when it starts, so every container start afterwards that requests it fails until dockerd restarts. Since #1067 runs the teardown on the GitHub runners, BuildKit failed each RUN of the swarm node image three times (run 39332343490, 39 of 40 swarm jobs): runc run failed: unable to start container process: error during container init: unable to apply apparmor profile: apparmor failed to apply profile: write .../attr/apparmor/exec: no such file or directory The teardown now removes each loaded profile by name through securityfs and skips `docker-default` and child profiles, which leave with their parent. Dev hosts gain the same: no dockerd restart is needed after `make environment-bootstrap`. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
AppArmor Administration 🛡️
This directory contains the AppArmor-facing maintenance layer for the local and CI development experience.
The focus here is not feature work, but control and safety: development workflows sometimes need a softer security posture, while cleanup paths must leave the system in a predictable state again. That makes this area less about convenience and more about trust, reversibility, and clear operational boundaries. 🔒
When changing anything in this area, prefer behavior that is:
- explicit rather than magical
- reversible rather than destructive
- capability-aware rather than assumption-driven
- quiet on unsupported systems, but loud when real integrity risks appear
In short: these files exist to help development move quickly without teaching the project to be careless around host security controls. ⚙️
For the canonical Make target index that invokes these helpers, see make.md.