Comment 6 for bug 981955

Ah. I see now. Thanks, guys.

There are actually two things you need to add to a configuration file to make this work. If I do:

cat > test.conf << EOF
lxc.aa_profile = unconfined
lxc.rootfs = /
EOF

lxc-execute -n test -f test.conf -- /bin/echo hi

That works for me.

Skipping the pinning of rootfs when lxc.rootfs = NULL would seem sensible. I'm not sure what we should do about the apparmor profile for this case.