Volumes and AppArmor: "lxc-start: Permission denied - failed to mount"

[metalivedev]

@jpetazzo worked through an issue where AppArmor prevents mounting a volume. This needs to get added to the Volumes "Known Issues".

The error looks like this in a build:

Problem

$ cat Dockerfile
# DOCKER-VERSION 0.6.1
FROM   ubuntu:12.04
VOLUME ["/var/run/foo"]
# No complaints if there are no writes after the above volume mount.
# Alternatively, this same error happens during `run` rather than `build`.
RUN    touch "/tmp/bar"

$ docker build -t test -rm=true .
Uploading context 10240 bytes
Step 1 : FROM ubuntu:12.04
 ---> 8dbd9e392a96
Step 2 : VOLUME ["/var/run/foo"]
 ---> Running in 44964a2d495d
 ---> 7766bb94fac5
Step 3 : RUN touch "/tmp/bar"
 ---> Running in a8823551642a
lxc-start: Permission denied - failed to mount '/var/lib/docker/volumes/b551c8189569a451642903fc7c636025aee082c835ee8b1b5993256e61f567b1/layer' on '/usr/lib/lxc/root///var/run/foo'
lxc-start: failed to setup the mount entries for 'a8823551642a82a4721fb48b945d4a0578a1c8b96ccf1417270df8b90f7857f7'
lxc-start: failed to setup the container
lxc-start: invalid sequence number 1. expected 2
lxc-start: failed to spawn 'a8823551642a82a4721fb48b945d4a0578a1c8b96ccf1417270df8b90f7857f7'
Error build: The command [/bin/sh -c touch "/tmp/bar"] returned a non-zero code: 255
The command [/bin/sh -c touch "/tmp/bar"] returned a non-zero code: 255

Context

Ubuntu Precise (12.04) and 13.04
chmoding permissions on the mounted volume makes no difference.
lxc version 0.7.5

Workaround

1. Install apparmor-utils if they aren't installed already.
2. Run $ aa-complain /usr/bin/lxc-start

That allows lxc-start and only issues a complaint instead of blocking it entirely.