From 2bbbb5f04d1b7233704c193f8837c64ac614f039 Mon Sep 17 00:00:00 2001
From: Damien <sepales.pret0h@icloud.com>
Date: Mon, 4 May 2026 14:56:11 +0200
Subject: [PATCH] Configure LXC for Docker and Tailscale

Add unconfined AppArmor profile to allow Docker and required TUN/TAP
device access for Tailscale in LXC container.
---
 gitea-runner/install.sh | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/gitea-runner/install.sh b/gitea-runner/install.sh
index 7565745..27ed746 100644
--- a/gitea-runner/install.sh
+++ b/gitea-runner/install.sh
@@ -96,8 +96,9 @@ create_lxc() {
     --features nesting=1,keyctl=1 \
     --start 0
 
-  log_info "Enabling TUN/TAP device for Tailscale..."
+  log_info "Configuring LXC for Docker and Tailscale..."
   cat >> "/etc/pve/lxc/${CTID}.conf" <<EOF
+lxc.apparmor.profile: unconfined
 lxc.cgroup2.devices.allow: c 10:200 rwm
 lxc.mount.entry: /dev/net dev/net none bind,create=dir
 lxc.mount.entry: /dev/net/tun dev/net/tun none bind,create=file