系统：
Debian 测试（Bullseye）
我正在尝试按照以下方式启动并运行 LXC 容器这里但是，当我到达时，lxc-start -n my-container -d我得到以下信息：
$ lxc-start -n test1 -d
lxc-start: test1: lxccontainer.c: wait_on_daemonized_start: 851 No such file or directory - Failed to receive the container state
lxc-start: test1: tools/lxc_start.c: main: 308 The container failed to start
lxc-start: test1: tools/lxc_start.c: main: 311 To get more details, run the container in foreground mode
lxc-start: test1: tools/lxc_start.c: main: 313 Additional information can be obtained by setting the --logfile and --logpriority options
在前台模式下运行它我得到
$ lxc-start -n test1 -F
lxc-start: test1: lsm/apparmor.c: apparmor_prepare: 1051 Cannot use generated profile: apparmor_parser not available
lxc-start: test1: start.c: lxc_init: 832 Failed to initialize LSM
lxc-start: test1: start.c: __lxc_start: 1945 Failed to initialize container "test1"
lxc-start: test1: tools/lxc_start.c: main: 308 The container failed to start
lxc-start: test1: tools/lxc_start.c: main: 313 Additional information can be obtained by setting the --logfile and --logpriority options
据我所知，到目前为止，apparmor_parser not available当未安装/启用 apparmor 时，就会发生错误。除了 apparmor 已安装并在我的系统上运行之外。
$ systemctl status apparmor.service
● apparmor.service - Load AppArmor profiles
Loaded: loaded (/lib/systemd/system/apparmor.service; enabled; vendor >
Active: active (exited) since Sat 2021-02-06 21:00:28 EST; 1h 37min ago
Docs: man:apparmor(7)
https://gitlab.com/apparmor/apparmor/wikis/home/
Main PID: 524 (code=exited, status=0/SUCCESS)
Tasks: 0 (limit: 8176)
Memory: 0B
CPU: 0
CGroup: /system.slice/apparmor.service
Warning: some journal files were not opened due to insufficient permissions.
是什么赋予了？
编辑：
以 root (sudo) 身份创建和运行容器按预期工作，但是链接中的说明还提供了以普通用户身份运行它们的说明。
产生systemd-run --unit=myshell --user --scope -p "Delegate=yes" lxc-start -l INFO -o test1.log test1以下日志
lxc-start test1 20210611133631.168 WARN apparmor - lsm/apparmor.c:lsm_apparmor_ops_init:1269 - Per-container AppArmor profiles are disabled because the mac_admin capability is missing
lxc-start test1 20210611133631.195 ERROR apparmor - lsm/apparmor.c:apparmor_prepare:1051 - Cannot use generated profile: apparmor_parser not available
lxc-start test1 20210611133631.195 ERROR start - start.c:lxc_init:832 - Failed to initialize LSM
lxc-start test1 20210611133631.195 ERROR start - start.c:__lxc_start:1945 - Failed to initialize container "test1"
lxc-start test1 20210611133631.712 ERROR lxccontainer - lxccontainer.c:wait_on_daemonized_start:851 - No such file or directory - Failed to receive the container state
lxc-start test1 20210611133631.712 ERROR lxc_start - tools/lxc_start.c:main:308 - The container failed to start
lxc-start test1 20210611133631.712 ERROR lxc_start - tools/lxc_start.c:main:311 - To get more details, run the container in foreground mode
lxc-start test1 20210611133631.712 ERROR lxc_start - tools/lxc_start.c:main:313 - Additional information can be obtained by setting the --logfile and --logpriority options
lxc-start test1 20210611133722.933 INFO confile - confile.c:set_config_idmaps:1942 - Read uid map: type u nsid 0 hostid 100000 range 65536
lxc-start test1 20210611133722.933 INFO confile - confile.c:set_config_idmaps:1942 - Read uid map: type g nsid 0 hostid 100000 range 65536
lxc-start test1 20210611133722.934 INFO lxccontainer - lxccontainer.c:do_lxcapi_start:979 - Set process title to [lxc monitor] /home/bobby/.local/share/lxc test1
lxc-start test1 20210611133722.934 WARN apparmor - lsm/apparmor.c:lsm_apparmor_ops_init:1269 - Per-container AppArmor profiles are disabled because the mac_admin capability is missing
lxc-start test1 20210611133722.934 INFO lsm - lsm/lsm.c:lsm_init:40 - Initialized LSM security driver AppArmor
lxc-start test1 20210611133722.935 INFO conf - conf.c:add_idmap_entry:4462 - Adding id map: type u nsid 0 hostid 100000 range 1
lxc-start test1 20210611133722.935 INFO conf - conf.c:add_idmap_entry:4462 - Adding id map: type u nsid 1000 hostid 1000 range 1
lxc-start test1 20210611133722.935 INFO conf - conf.c:add_idmap_entry:4462 - Adding id map: type g nsid 0 hostid 100000 range 1
lxc-start test1 20210611133722.935 INFO conf - conf.c:add_idmap_entry:4462 - Adding id map: type g nsid 1000 hostid 1000 range 1
lxc-start test1 20210611133722.935 INFO conf - conf.c:add_idmap_entry:4462 - Adding id map: type g nsid 5 hostid 100005 range 1
lxc-start test1 20210611133722.942 NOTICE utils - utils.c:lxc_switch_uid_gid:1398 - Switched to gid 0
lxc-start test1 20210611133722.942 NOTICE utils - utils.c:lxc_switch_uid_gid:1407 - Switched to uid 0
lxc-start test1 20210611133722.942 NOTICE utils - utils.c:lxc_setgroups:1420 - Dropped additional groups
lxc-start test1 20210611133722.943 INFO seccomp - seccomp.c:parse_config_v2:807 - Processing "reject_force_umount # comment this to allow umount -f; not recommended"
lxc-start test1 20210611133722.943 INFO seccomp - seccomp.c:do_resolve_add_rule:524 - Set seccomp rule to reject force umounts
lxc-start test1 20210611133722.943 INFO seccomp - seccomp.c:do_resolve_add_rule:524 - Set seccomp rule to reject force umounts
lxc-start test1 20210611133722.943 INFO seccomp - seccomp.c:do_resolve_add_rule:524 - Set seccomp rule to reject force umounts
lxc-start test1 20210611133722.943 INFO seccomp - seccomp.c:parse_config_v2:807 - Processing "[all]"
lxc-start test1 20210611133722.943 INFO seccomp - seccomp.c:parse_config_v2:807 - Processing "kexec_load errno 1"
lxc-start test1 20210611133722.943 INFO seccomp - seccomp.c:do_resolve_add_rule:564 - Adding native rule for syscall[246:kexec_load] action[327681:errno] arch[0]
lxc-start test1 20210611133722.943 INFO seccomp - seccomp.c:do_resolve_add_rule:564 - Adding compat rule for syscall[246:kexec_load] action[327681:errno] arch[1073741827]
lxc-start test1 20210611133722.943 INFO seccomp - seccomp.c:do_resolve_add_rule:564 - Adding compat rule for syscall[246:kexec_load] action[327681:errno] arch[1073741886]
lxc-start test1 20210611133722.943 INFO seccomp - seccomp.c:parse_config_v2:807 - Processing "open_by_handle_at errno 1"
lxc-start test1 20210611133722.943 INFO seccomp - seccomp.c:do_resolve_add_rule:564 - Adding native rule for syscall[304:open_by_handle_at] action[327681:errno] arch[0]
lxc-start test1 20210611133722.943 INFO seccomp - seccomp.c:do_resolve_add_rule:564 - Adding compat rule for syscall[304:open_by_handle_at] action[327681:errno] arch[1073741827]
lxc-start test1 20210611133722.943 INFO seccomp - seccomp.c:do_resolve_add_rule:564 - Adding compat rule for syscall[304:open_by_handle_at] action[327681:errno] arch[1073741886]
lxc-start test1 20210611133722.943 INFO seccomp - seccomp.c:parse_config_v2:807 - Processing "init_module errno 1"
lxc-start test1 20210611133722.943 INFO seccomp - seccomp.c:do_resolve_add_rule:564 - Adding native rule for syscall[175:init_module] action[327681:errno] arch[0]
lxc-start test1 20210611133722.943 INFO seccomp - seccomp.c:do_resolve_add_rule:564 - Adding compat rule for syscall[175:init_module] action[327681:errno] arch[1073741827]
lxc-start test1 20210611133722.943 INFO seccomp - seccomp.c:do_resolve_add_rule:564 - Adding compat rule for syscall[175:init_module] action[327681:errno] arch[1073741886]
lxc-start test1 20210611133722.943 INFO seccomp - seccomp.c:parse_config_v2:807 - Processing "finit_module errno 1"
lxc-start test1 20210611133722.943 INFO seccomp - seccomp.c:do_resolve_add_rule:564 - Adding native rule for syscall[313:finit_module] action[327681:errno] arch[0]
lxc-start test1 20210611133722.943 INFO seccomp - seccomp.c:do_resolve_add_rule:564 - Adding compat rule for syscall[313:finit_module] action[327681:errno] arch[1073741827]
lxc-start test1 20210611133722.943 INFO seccomp - seccomp.c:do_resolve_add_rule:564 - Adding compat rule for syscall[313:finit_module] action[327681:errno] arch[1073741886]
lxc-start test1 20210611133722.943 INFO seccomp - seccomp.c:parse_config_v2:807 - Processing "delete_module errno 1"
lxc-start test1 20210611133722.943 INFO seccomp - seccomp.c:do_resolve_add_rule:564 - Adding native rule for syscall[176:delete_module] action[327681:errno] arch[0]
lxc-start test1 20210611133722.943 INFO seccomp - seccomp.c:do_resolve_add_rule:564 - Adding compat rule for syscall[176:delete_module] action[327681:errno] arch[1073741827]
lxc-start test1 20210611133722.943 INFO seccomp - seccomp.c:do_resolve_add_rule:564 - Adding compat rule for syscall[176:delete_module] action[327681:errno] arch[1073741886]
lxc-start test1 20210611133722.943 INFO seccomp - seccomp.c:parse_config_v2:1017 - Merging compat seccomp contexts into main context
lxc-start test1 20210611133722.945 ERROR apparmor - lsm/apparmor.c:apparmor_prepare:1051 - Cannot use generated profile: apparmor_parser not available
lxc-start test1 20210611133722.945 ERROR start - start.c:lxc_init:832 - Failed to initialize LSM
lxc-start test1 20210611133722.945 ERROR start - start.c:__lxc_start:1945 - Failed to initialize container "test1"
lxc-start test1 20210611133722.951 NOTICE utils - utils.c:lxc_setgroups:1420 - Dropped additional groups
lxc-start test1 20210611133722.951 INFO conf - conf.c:run_script_argv:330 - Executing script "/usr/share/lxcfs/lxc.reboot.hook" for container "test1", config section "lxc"
lxc-start test1 20210611133723.454 ERROR lxccontainer - lxccontainer.c:wait_on_daemonized_start:851 - No such file or directory - Failed to receive the container state
lxc-start test1 20210611133723.454 ERROR lxc_start - tools/lxc_start.c:main:308 - The container failed to start
lxc-start test1 20210611133723.454 ERROR lxc_start - tools/lxc_start.c:main:311 - To get more details, run the container in foreground mode
lxc-start test1 20210611133723.454 ERROR lxc_start - tools/lxc_start.c:main:313 - Additional information can be obtained by setting the --logfile and --logpriority options
lxc-start test1 20210611133821.478 INFO confile - confile.c:set_config_idmaps:1942 - Read uid map: type u nsid 0 hostid 100000 range 65536
lxc-start test1 20210611133821.478 INFO confile - confile.c:set_config_idmaps:1942 - Read uid map: type g nsid 0 hostid 100000 range 65536
lxc-start test1 20210611133821.478 INFO lxccontainer - lxccontainer.c:do_lxcapi_start:979 - Set process title to [lxc monitor] /home/bobby/.local/share/lxc test1
lxc-start test1 20210611133821.479 WARN apparmor - lsm/apparmor.c:lsm_apparmor_ops_init:1269 - Per-container AppArmor profiles are disabled because the mac_admin capability is missing
lxc-start test1 20210611133821.479 INFO lsm - lsm/lsm.c:lsm_init:40 - Initialized LSM security driver AppArmor
lxc-start test1 20210611133821.480 INFO conf - conf.c:add_idmap_entry:4462 - Adding id map: type u nsid 0 hostid 100000 range 1
lxc-start test1 20210611133821.480 INFO conf - conf.c:add_idmap_entry:4462 - Adding id map: type u nsid 1000 hostid 1000 range 1
lxc-start test1 20210611133821.480 INFO conf - conf.c:add_idmap_entry:4462 - Adding id map: type g nsid 0 hostid 100000 range 1
lxc-start test1 20210611133821.480 INFO conf - conf.c:add_idmap_entry:4462 - Adding id map: type g nsid 1000 hostid 1000 range 1
lxc-start test1 20210611133821.480 INFO conf - conf.c:add_idmap_entry:4462 - Adding id map: type g nsid 5 hostid 100005 range 1
lxc-start test1 20210611133821.487 NOTICE utils - utils.c:lxc_switch_uid_gid:1398 - Switched to gid 0
lxc-start test1 20210611133821.487 NOTICE utils - utils.c:lxc_switch_uid_gid:1407 - Switched to uid 0
lxc-start test1 20210611133821.487 NOTICE utils - utils.c:lxc_setgroups:1420 - Dropped additional groups
lxc-start test1 20210611133821.488 INFO seccomp - seccomp.c:parse_config_v2:807 - Processing "reject_force_umount # comment this to allow umount -f; not recommended"
lxc-start test1 20210611133821.488 INFO seccomp - seccomp.c:do_resolve_add_rule:524 - Set seccomp rule to reject force umounts
lxc-start test1 20210611133821.488 INFO seccomp - seccomp.c:do_resolve_add_rule:524 - Set seccomp rule to reject force umounts
lxc-start test1 20210611133821.488 INFO seccomp - seccomp.c:do_resolve_add_rule:524 - Set seccomp rule to reject force umounts
lxc-start test1 20210611133821.488 INFO seccomp - seccomp.c:parse_config_v2:807 - Processing "[all]"
lxc-start test1 20210611133821.488 INFO seccomp - seccomp.c:parse_config_v2:807 - Processing "kexec_load errno 1"
lxc-start test1 20210611133821.488 INFO seccomp - seccomp.c:do_resolve_add_rule:564 - Adding native rule for syscall[246:kexec_load] action[327681:errno] arch[0]
lxc-start test1 20210611133821.488 INFO seccomp - seccomp.c:do_resolve_add_rule:564 - Adding compat rule for syscall[246:kexec_load] action[327681:errno] arch[1073741827]
lxc-start test1 20210611133821.488 INFO seccomp - seccomp.c:do_resolve_add_rule:564 - Adding compat rule for syscall[246:kexec_load] action[327681:errno] arch[1073741886]
lxc-start test1 20210611133821.488 INFO seccomp - seccomp.c:parse_config_v2:807 - Processing "open_by_handle_at errno 1"
lxc-start test1 20210611133821.488 INFO seccomp - seccomp.c:do_resolve_add_rule:564 - Adding native rule for syscall[304:open_by_handle_at] action[327681:errno] arch[0]
lxc-start test1 20210611133821.488 INFO seccomp - seccomp.c:do_resolve_add_rule:564 - Adding compat rule for syscall[304:open_by_handle_at] action[327681:errno] arch[1073741827]
lxc-start test1 20210611133821.488 INFO seccomp - seccomp.c:do_resolve_add_rule:564 - Adding compat rule for syscall[304:open_by_handle_at] action[327681:errno] arch[1073741886]
lxc-start test1 20210611133821.488 INFO seccomp - seccomp.c:parse_config_v2:807 - Processing "init_module errno 1"
lxc-start test1 20210611133821.488 INFO seccomp - seccomp.c:do_resolve_add_rule:564 - Adding native rule for syscall[175:init_module] action[327681:errno] arch[0]
lxc-start test1 20210611133821.488 INFO seccomp - seccomp.c:do_resolve_add_rule:564 - Adding compat rule for syscall[175:init_module] action[327681:errno] arch[1073741827]
lxc-start test1 20210611133821.488 INFO seccomp - seccomp.c:do_resolve_add_rule:564 - Adding compat rule for syscall[175:init_module] action[327681:errno] arch[1073741886]
lxc-start test1 20210611133821.488 INFO seccomp - seccomp.c:parse_config_v2:807 - Processing "finit_module errno 1"
lxc-start test1 20210611133821.488 INFO seccomp - seccomp.c:do_resolve_add_rule:564 - Adding native rule for syscall[313:finit_module] action[327681:errno] arch[0]
lxc-start test1 20210611133821.488 INFO seccomp - seccomp.c:do_resolve_add_rule:564 - Adding compat rule for syscall[313:finit_module] action[327681:errno] arch[1073741827]
lxc-start test1 20210611133821.488 INFO seccomp - seccomp.c:do_resolve_add_rule:564 - Adding compat rule for syscall[313:finit_module] action[327681:errno] arch[1073741886]
lxc-start test1 20210611133821.488 INFO seccomp - seccomp.c:parse_config_v2:807 - Processing "delete_module errno 1"
lxc-start test1 20210611133821.488 INFO seccomp - seccomp.c:do_resolve_add_rule:564 - Adding native rule for syscall[176:delete_module] action[327681:errno] arch[0]
lxc-start test1 20210611133821.488 INFO seccomp - seccomp.c:do_resolve_add_rule:564 - Adding compat rule for syscall[176:delete_module] action[327681:errno] arch[1073741827]
lxc-start test1 20210611133821.488 INFO seccomp - seccomp.c:do_resolve_add_rule:564 - Adding compat rule for syscall[176:delete_module] action[327681:errno] arch[1073741886]
lxc-start test1 20210611133821.488 INFO seccomp - seccomp.c:parse_config_v2:1017 - Merging compat seccomp contexts into main context
lxc-start test1 20210611133821.568 ERROR apparmor - lsm/apparmor.c:make_apparmor_namespace:840 - Permission denied - Error creating AppArmor namespace: /sys/kernel/security/apparmor/policy/namespaces/lxc-test1_<-home-bobby-.local-share-lxc>
lxc-start test1 20210611133821.568 ERROR apparmor - lsm/apparmor.c:apparmor_prepare:1057 - Failed to load generated AppArmor profile
lxc-start test1 20210611133821.568 ERROR start - start.c:lxc_init:832 - Failed to initialize LSM
lxc-start test1 20210611133821.568 ERROR start - start.c:__lxc_start:1945 - Failed to initialize container "test1"
lxc-start test1 20210611133821.575 NOTICE utils - utils.c:lxc_setgroups:1420 - Dropped additional groups
lxc-start test1 20210611133821.576 INFO conf - conf.c:run_script_argv:330 - Executing script "/usr/share/lxcfs/lxc.reboot.hook" for container "test1", config section "lxc"
lxc-start test1 20210611133822.796 ERROR lxccontainer - lxccontainer.c:wait_on_daemonized_start:851 - No such file or directory - Failed to receive the container state
lxc-start test1 20210611133822.798 ERROR lxc_start - tools/lxc_start.c:main:308 - The container failed to start
lxc-start test1 20210611133822.801 ERROR lxc_start - tools/lxc_start.c:main:311 - To get more details, run the container in foreground mode
lxc-start test1 20210611133822.802 ERROR lxc_start - tools/lxc_start.c:main:313 - Additional information can be obtained by setting the --logfile and --logpriority options
lxc-start test1 20210611133926.195 INFO confile - confile.c:set_config_idmaps:1942 - Read uid map: type u nsid 0 hostid 100000 range 65536
lxc-start test1 20210611133926.195 INFO confile - confile.c:set_config_idmaps:1942 - Read uid map: type g nsid 0 hostid 100000 range 65536
lxc-start test1 20210611133926.196 INFO lxccontainer - lxccontainer.c:do_lxcapi_start:979 - Set process title to [lxc monitor] /home/bobby/.local/share/lxc test1
lxc-start test1 20210611133926.196 WARN apparmor - lsm/apparmor.c:lsm_apparmor_ops_init:1269 - Per-container AppArmor profiles are disabled because the mac_admin capability is missing
lxc-start test1 20210611133926.196 INFO lsm - lsm/lsm.c:lsm_init:40 - Initialized LSM security driver AppArmor
lxc-start test1 20210611133926.196 INFO conf - conf.c:add_idmap_entry:4462 - Adding id map: type u nsid 0 hostid 100000 range 1
lxc-start test1 20210611133926.196 INFO conf - conf.c:add_idmap_entry:4462 - Adding id map: type u nsid 1000 hostid 1000 range 1
lxc-start test1 20210611133926.196 INFO conf - conf.c:add_idmap_entry:4462 - Adding id map: type g nsid 0 hostid 100000 range 1
lxc-start test1 20210611133926.196 INFO conf - conf.c:add_idmap_entry:4462 - Adding id map: type g nsid 1000 hostid 1000 range 1
lxc-start test1 20210611133926.196 INFO conf - conf.c:add_idmap_entry:4462 - Adding id map: type g nsid 5 hostid 100005 range 1
lxc-start test1 20210611133926.199 NOTICE utils - utils.c:lxc_switch_uid_gid:1398 - Switched to gid 0
lxc-start test1 20210611133926.199 NOTICE utils - utils.c:lxc_switch_uid_gid:1407 - Switched to uid 0
lxc-start test1 20210611133926.200 NOTICE utils - utils.c:lxc_setgroups:1420 - Dropped additional groups
lxc-start test1 20210611133926.200 INFO seccomp - seccomp.c:parse_config_v2:807 - Processing "reject_force_umount # comment this to allow umount -f; not recommended"
lxc-start test1 20210611133926.200 INFO seccomp - seccomp.c:do_resolve_add_rule:524 - Set seccomp rule to reject force umounts
lxc-start test1 20210611133926.200 INFO seccomp - seccomp.c:do_resolve_add_rule:524 - Set seccomp rule to reject force umounts
lxc-start test1 20210611133926.200 INFO seccomp - seccomp.c:do_resolve_add_rule:524 - Set seccomp rule to reject force umounts
lxc-start test1 20210611133926.200 INFO seccomp - seccomp.c:parse_config_v2:807 - Processing "[all]"
lxc-start test1 20210611133926.200 INFO seccomp - seccomp.c:parse_config_v2:807 - Processing "kexec_load errno 1"
lxc-start test1 20210611133926.200 INFO seccomp - seccomp.c:do_resolve_add_rule:564 - Adding native rule for syscall[246:kexec_load] action[327681:errno] arch[0]
lxc-start test1 20210611133926.200 INFO seccomp - seccomp.c:do_resolve_add_rule:564 - Adding compat rule for syscall[246:kexec_load] action[327681:errno] arch[1073741827]
lxc-start test1 20210611133926.200 INFO seccomp - seccomp.c:do_resolve_add_rule:564 - Adding compat rule for syscall[246:kexec_load] action[327681:errno] arch[1073741886]
lxc-start test1 20210611133926.200 INFO seccomp - seccomp.c:parse_config_v2:807 - Processing "open_by_handle_at errno 1"
lxc-start test1 20210611133926.200 INFO seccomp - seccomp.c:do_resolve_add_rule:564 - Adding native rule for syscall[304:open_by_handle_at] action[327681:errno] arch[0]
lxc-start test1 20210611133926.200 INFO seccomp - seccomp.c:do_resolve_add_rule:564 - Adding compat rule for syscall[304:open_by_handle_at] action[327681:errno] arch[1073741827]
lxc-start test1 20210611133926.200 INFO seccomp - seccomp.c:do_resolve_add_rule:564 - Adding compat rule for syscall[304:open_by_handle_at] action[327681:errno] arch[1073741886]
lxc-start test1 20210611133926.200 INFO seccomp - seccomp.c:parse_config_v2:807 - Processing "init_module errno 1"
lxc-start test1 20210611133926.200 INFO seccomp - seccomp.c:do_resolve_add_rule:564 - Adding native rule for syscall[175:init_module] action[327681:errno] arch[0]
lxc-start test1 20210611133926.200 INFO seccomp - seccomp.c:do_resolve_add_rule:564 - Adding compat rule for syscall[175:init_module] action[327681:errno] arch[1073741827]
lxc-start test1 20210611133926.200 INFO seccomp - seccomp.c:do_resolve_add_rule:564 - Adding compat rule for syscall[175:init_module] action[327681:errno] arch[1073741886]
lxc-start test1 20210611133926.200 INFO seccomp - seccomp.c:parse_config_v2:807 - Processing "finit_module errno 1"
lxc-start test1 20210611133926.200 INFO seccomp - seccomp.c:do_resolve_add_rule:564 - Adding native rule for syscall[313:finit_module] action[327681:errno] arch[0]
lxc-start test1 20210611133926.200 INFO seccomp - seccomp.c:do_resolve_add_rule:564 - Adding compat rule for syscall[313:finit_module] action[327681:errno] arch[1073741827]
lxc-start test1 20210611133926.200 INFO seccomp - seccomp.c:do_resolve_add_rule:564 - Adding compat rule for syscall[313:finit_module] action[327681:errno] arch[1073741886]
lxc-start test1 20210611133926.200 INFO seccomp - seccomp.c:parse_config_v2:807 - Processing "delete_module errno 1"
lxc-start test1 20210611133926.200 INFO seccomp - seccomp.c:do_resolve_add_rule:564 - Adding native rule for syscall[176:delete_module] action[327681:errno] arch[0]
lxc-start test1 20210611133926.200 INFO seccomp - seccomp.c:do_resolve_add_rule:564 - Adding compat rule for syscall[176:delete_module] action[327681:errno] arch[1073741827]
lxc-start test1 20210611133926.200 INFO seccomp - seccomp.c:do_resolve_add_rule:564 - Adding compat rule for syscall[176:delete_module] action[327681:errno] arch[1073741886]
lxc-start test1 20210611133926.200 INFO seccomp - seccomp.c:parse_config_v2:1017 - Merging compat seccomp contexts into main context
lxc-start test1 20210611133926.201 ERROR apparmor - lsm/apparmor.c:make_apparmor_namespace:840 - Permission denied - Error creating AppArmor namespace: /sys/kernel/security/apparmor/policy/namespaces/lxc-test1_<-home-bobby-.local-share-lxc>
lxc-start test1 20210611133926.201 ERROR apparmor - lsm/apparmor.c:apparmor_prepare:1057 - Failed to load generated AppArmor profile
lxc-start test1 20210611133926.201 ERROR start - start.c:lxc_init:832 - Failed to initialize LSM
lxc-start test1 20210611133926.201 ERROR start - start.c:__lxc_start:1945 - Failed to initialize container "test1"
lxc-start test1 20210611133926.204 NOTICE utils - utils.c:lxc_setgroups:1420 - Dropped additional groups
lxc-start test1 20210611133926.204 INFO conf - conf.c:run_script_argv:330 - Executing script "/usr/share/lxcfs/lxc.reboot.hook" for container "test1", config section "lxc"
lxc-start test1 20210611133926.706 ERROR lxccontainer - lxccontainer.c:wait_on_daemonized_start:851 - No such file or directory - Failed to receive the container state
lxc-start test1 20210611133926.707 ERROR lxc_start - tools/lxc_start.c:main:308 - The container failed to start
lxc-start test1 20210611133926.707 ERROR lxc_start - tools/lxc_start.c:main:311 - To get more details, run the container in foreground mode
lxc-start test1 20210611133926.707 ERROR lxc_start - tools/lxc_start.c:main:313 - Additional information can be obtained by setting the --logfile and --logpriority options
答案1
我在 Debian Buster 上遇到了完全相同的问题，我的解决方案是将 or /usr/sbin（/sbin因为apparmor_*留在那里）就像$PATH我在这个链接中看到的那样：
https://github.com/lxc/lxc/issues/3049
~/.bashrc将以下命令放在当前用户或所有用户的最后一行/etc/profile（谢谢，Thomas N！）：
export PATH=/sbin:/usr/sbin:$PATH
之后更新您的终端source ~/.bashrc或source /etc/profile.
答案2
非特权用户无法创建 apparmor命名空间。使用lxc.apparmor.profile = unconfined。这也是Debian Wiki 建议什么。您也可以尝试lxc.apparmor.profile = lxc-container-default-cgns，但在这种情况下，网络在容器中不起作用。
答案3
这是一条评论，我只是想附上我的配置，它可能对你有帮助。 Debian 上的 LXC 稳定版 - Buster，没有 apparmor，我在开始使用 lxc 之前已经卸载了它；所以我无法对 lxc + apparmor 提出建议。但没有 apparmor 的 lxc 也是可能的。
/etc/lxc/default.conf
lxc.apparmor.profile = unconfined
lxc.apparmor.allow_nesting = 0
lxc.mount.auto = proc:mixed sys:ro cgroup:mixed
lxc.net.0.type = veth
lxc.net.0.link = lxcbr0
lxc.net.0.flags = up
lxc.net.0.hwaddr = 00:FF:xx:xx:xx:xx