Update AppArmor template to allow confined runc to kill containers

[Sebastian Podjasek]

Is there any chance that this PR can be implemented to current Ubuntu release?

Because as for now apparmor denies signals from runc and this results in many pods kept in Terminating state:

audit: type=1400 audit(1715342953.323:200): apparmor="DENIED" operation="signal" class="signal" profile="cri-containerd.apparmor.d" pid=741102 comm="runc" requested_mask="receive" denied_mask="receive" signal=kill peer="runc"

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[Dmitrii Kuptsov (bcskda)]

Seeing this in Noble containerd 1.7.12-0ubuntu4
Seems to be https://github.com/containerd/containerd/pull/10123

[Sebastian Podjasek (sebastian-podjasek)]

Forgot to paste link to PR related to issue above :/

https://github.com/containerd/containerd/pull/10129

[Christopher J. Ruwe (cruwe)]

I am to some extend amazed considering so few users participate in this discussion.

I'd expect every user of Kubernetes, using containerd and app_armor on an Ubuntu 24.04 to be affected. To get my clusters in a sustainable state, I deactivated app_armor for containerd as a stop-gap measure, expecting the need for bumping containerd to be high and an updated package to appear soon.

Am I in some respect wrong in my assumption? Is running K8S on 24.04 with app_armor-ed containerd an edge case?

Thanks for your consideration.

[Sebastian Podjasek (sebastian-podjasek)]

Apparently, that's the fate of early adopters...

I've managed to "hand-craft" following apparmor profile and place it in: /etc/apparmor.d/cri-containerd.apparmor.d as a temporary solution for this problem.