AppArmor profile "error while loading shared libraries: libc.so.6"

Expected Behavior

To be able to run using the autogenerated AppArmor profile.

Actual Behavior

I've tried this on 3 versions of Ubuntu, on version of Debian, with runc and containerd. Its always the same issue with libc.so.6. The slim container works file with the autogenerated SecComp profile or not profile, just not the AppArmor one.

Steps to Reproduce the Problem

1. Fresh OS install

2. apt update ; apt ugprade

3. Install Docker CE (from web) or docker.io (from apt)

4. root@u:~# docker pull nginx:latest
   latest: Pulling from library/nginx
   214ca5fb9032: Pull complete
   f0156b83954c: Pull complete
   5c4340f87b72: Pull complete
   9de84a6a72f5: Pull complete
   63f91b232fe3: Pull complete
   860d24db679a: Pull complete
   Digest: sha256:2c72b42c3679c1c819d46296c4e79e69b2616fa28bea92e61d358980e18c9751
   Status: Downloaded newer image for nginx:latest
   docker.io/library/nginx:latest

5. root@u:~# docker-slim build nginx
   docker-slim: message='join the Gitter channel to ask questions or to share your feedback' info='https://gitter.im/docker-slim/community'
   docker-slim: message='join the Discord server to ask questions or to share your feedback' info='https://discord.gg/9tDyxYS'
   docker-slim: message='Github discussions' info='https://github.com/docker-slim/docker-slim/discussions'
   cmd=build info=param.http.probe message='using default probe'
   cmd=build state=started
   cmd=build info=params tags='' target.type='image' target='nginx' continue.mode='probe' rt.as.user='true' keep.perms='true'
   cmd=build state=image.inspection.start
   cmd=build info=image id='sha256:7425d3a7c478efbeb75f0937060117343a9a510f72f5f7ad9f14b1501a36940c' size.bytes='141522805' size.human='142 MB'
   cmd=build info=image.stack index='0' name='nginx:latest' id='sha256:7425d3a7c478efbeb75f0937060117343a9a510f72f5f7ad9f14b1501a36940c'
   cmd=build info=image.exposed_ports list='80'
   cmd=build state=image.inspection.done
   cmd=build state=container.inspection.start
   cmd=build info=container status='created' name='dockerslimk_11493_20220514215859' id='590ddc868ba3ae27cdfe1c4c1c6b012baabb10074e36d74ea7bfcfcb92422682'
   cmd=build info=container status='running' name='dockerslimk_11493_20220514215859' id='590ddc868ba3ae27cdfe1c4c1c6b012baabb10074e36d74ea7bfcfcb92422682'
   cmd=build info=container message='obtained IP address' ip='172.17.0.2'
   cmd=build info=cmd.startmonitor status='sent'
   cmd=build info=event.startmonitor.done status='received'
   cmd=build info=container target.port.info='80/tcp => 0.0.0.0:49155' message='YOU CAN USE THESE PORTS TO INTERACT WITH THE CONTAINER' name='dockerslimk_11493_20220514215859' id='590ddc868ba3ae27cdfe1c4c1c6b012baabb10074e36d74ea7bfcfcb92422682' target.port.list='49155'
   cmd=build state=http.probe.starting message="WAIT FOR HTTP PROBE TO FINISH"
   cmd=build info=continue.after mode='probe' message='no input required, execution will resume when HTTP probing is completed'
   cmd=build prompt='waiting for the HTTP probe to finish'
   cmd=build state=http.probe.running
   cmd=build info=http.probe.ports count='1' targets='49155'
   cmd=build info=http.probe.commands count='1' commands='GET /'
   cmd=build info=http.probe.call status='200' method='GET' target='http://127.0.0.1:49155/' attempt='1' error='none' time='2022-05-14T21:59:11Z'
   cmd=build info=http.probe.summary total='1' failures='0' successful='1'
   cmd=build state=http.probe.done
   cmd=build info=http.probe.crawler page='0' url='http://127.0.0.1:49155/'
   cmd=build info=probe.crawler.done addr='http://127.0.0.1:49155/'
   cmd=build info=event message='HTTP probe is done'
   cmd=build state=container.inspection.finishing
   cmd=build state=container.inspection.artifact.processing
   cmd=build state=container.inspection.done
   cmd=build state=building message="building optimized image"
   cmd=build state=completed
   cmd=build info=results status='MINIFIED' by='11.68X' size.original='142 MB' size.optimized='12 MB'
   cmd=build info=results image.name='nginx.slim' image.size='12 MB' has.data='true'
   cmd=build info=results artifacts.location='/tmp/docker-slim-state/.docker-slim-state/images/7425d3a7c478efbeb75f0937060117343a9a510f72f5f7ad9f14b1501a36940c/artifacts'
   cmd=build info=results artifacts.report='creport.json'
   cmd=build info=results artifacts.dockerfile.reversed='Dockerfile.fat'
   cmd=build info=results artifacts.dockerfile.optimized='Dockerfile'
   cmd=build info=results artifacts.seccomp='nginx-seccomp.json'
   cmd=build info=results artifacts.apparmor='nginx-apparmor-profile'
   cmd=build state=done
   cmd=build info=commands message='use the xray command to learn more about the optimize image'
   cmd=build info=report file='slim.report.json'
   docker-slim: message='join the Gitter channel to ask questions or to share your feedback' info='https://gitter.im/docker-slim/community'
   docker-slim: message='join the Discord server to ask questions or to share your feedback' info='https://discord.gg/9tDyxYS'
   docker-slim: message='Github discussions' info='https://github.com/docker-slim/docker-slim/discussions'

6. root@u:~# cd /tmp/docker-slim-state/.docker-slim-state/images/7425d3a7c478efbeb75f0937060117343a9a510f72f5f7ad9f14b1501a36940c/artifacts/

7. root@u:/tmp/docker-slim-state/.docker-slim-state/images/7425d3a7c478efbeb75f0937060117343a9a510f72f5f7ad9f14b1501a36940c/artifacts# apparmor_parser nginx-apparmor-profile

8. root@u:~# docker run -p 12345:80 --security-opt "apparmor=nginx-apparmor-profile" nginx.slim
   /bin/sh: error while loading shared libraries: libc.so.6: failed to map segment from shared object

Specifications

cmd=version info=app version='linux|Transformer|1.37.6|26a36c88a94c677efd734e874ba081dabb84a224|2022-04-23_06:03:56AM' container=false dsimage=false
cmd=version info=app outdated=false current=1.37.6 verdict='you have the latest version'
cmd=version info=app location='/usr/local/bin'
cmd=version info=host osname='Ubuntu 18.04.6 LTS'
cmd=version info=host osbuild=
cmd=version info=host version='#184-Ubuntu SMP Thu Mar 24 17:48:36 UTC 2022'
cmd=version info=host release=4.15.0-175-generic
cmd=version info=host sysname=Linux
cmd=version info=docker name=u
cmd=version info=docker kernel_version=4.15.0-175-generic
cmd=version info=docker operating_system=Ubuntu 18.04.6 LTS
cmd=version info=docker ostype=linux
cmd=version info=docker server_version=20.10.7
cmd=version info=docker architecture=x86_64
cmd=version info=dclient api_version=1.41
cmd=version info=dclient min_api_version=1.12
cmd=version info=dclient build_time=2021-10-22T00:57:37.000000000+00:00
cmd=version info=dclient git_commit=20.10.7-0ubuntu5~18.04.3

AppArmor Profile

root@u:~# cat /tmp/docker-slim-state/.docker-slim-state/images/7425d3a7c478efbeb75f0937060117343a9a510f72f5f7ad9f14b1501a36940c/artifacts/nginx-apparmor-profile

profile nginx-apparmor-profile flags=(attach_disconnected,mediate_deleted) {

network,

/bin/dash rix,
/bin/grep rix,
/usr/bin/env rix,
/usr/bin/find rix,

/run/nginx.pid w,

/bin/sed r,
/bin/sh r,
/bin/touch r,
/dev/stderr r,
/dev/stdout r,
/docker-entrypoint.d/10-listen-on-ipv6-by-default.sh r,
/docker-entrypoint.d/20-envsubst-on-templates.sh r,
/docker-entrypoint.d/30-tune-worker-processes.sh r,
/docker-entrypoint.sh r,
/etc/group r,
/etc/ld.so.cache r,
/etc/localtime r,
/etc/nginx/conf.d/default.conf r,
/etc/nginx/mime.types r,
/etc/nginx/nginx.conf r,
/etc/nsswitch.conf r,
/etc/os-release r,
/etc/passwd r,
/etc/ssl/openssl.cnf r,
/lib/x86_64-linux-gnu/ld-2.31.so r,
/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2 r,
/lib/x86_64-linux-gnu/libc-2.31.so r,
/lib/x86_64-linux-gnu/libc.so.6 r,
/lib/x86_64-linux-gnu/libcrypt.so.1 r,
/lib/x86_64-linux-gnu/libcrypt.so.1.1.0 r,
/lib/x86_64-linux-gnu/libdl-2.31.so r,
/lib/x86_64-linux-gnu/libdl.so.2 r,
/lib/x86_64-linux-gnu/libm-2.31.so r,
/lib/x86_64-linux-gnu/libm.so.6 r,
/lib/x86_64-linux-gnu/libnss_files-2.31.so r,
/lib/x86_64-linux-gnu/libnss_files.so.2 r,
/lib/x86_64-linux-gnu/libpcre.so.3 r,
/lib/x86_64-linux-gnu/libpcre.so.3.13.3 r,
/lib/x86_64-linux-gnu/libpthread-2.31.so r,
/lib/x86_64-linux-gnu/libpthread.so.0 r,
/lib/x86_64-linux-gnu/libselinux.so.1 r,
/lib/x86_64-linux-gnu/libz.so.1 r,
/lib/x86_64-linux-gnu/libz.so.1.2.11 r,
/lib64/ld-linux-x86-64.so.2 r,
/proc/self/fd/1 r,
/proc/self/fd/2 r,
/usr/bin/basename r,
/usr/bin/cut r,
/usr/bin/dpkg-query r,
/usr/bin/md5sum r,
/usr/bin/md5sum.textutils r,
/usr/bin/sort r,
/usr/bin/touch r,
/usr/lib/os-release r,
/usr/lib/ssl/openssl.cnf r,
/usr/lib/x86_64-linux-gnu/libacl.so.1 r,
/usr/lib/x86_64-linux-gnu/libacl.so.1.1.2253 r,
/usr/lib/x86_64-linux-gnu/libcrypto.so.1.1 r,
/usr/lib/x86_64-linux-gnu/libpcre2-8.so.0 r,
/usr/lib/x86_64-linux-gnu/libpcre2-8.so.0.10.1 r,
/usr/lib/x86_64-linux-gnu/libssl.so.1.1 r,
/usr/sbin/nginx r,
/usr/share/nginx/html/index.html r,
/usr/share/zoneinfo/Etc/UCT r,
/usr/share/zoneinfo/Etc/UTC r,
/usr/share/zoneinfo/Etc/Universal r,
/usr/share/zoneinfo/Etc/Zulu r,
/usr/share/zoneinfo/UCT r,
/usr/share/zoneinfo/UTC r,
/usr/share/zoneinfo/Universal r,
/usr/share/zoneinfo/Zulu r,
/usr/share/zoneinfo/localtime r,
/var/lib/dpkg/status r,
/var/lib/dpkg/triggers/Unincorp r,
/var/log/nginx/access.log r,
/var/log/nginx/error.log r,
/var/run r,
/var/run/nginx.pid r,

}

Reproduce the failure with the generated nginx-apparmor-profile, the nginx.slim image, and the shown docker run command; compare it with runs using the autogenerated Seccomp profile or no profile. Inspect the generated profile and its listed library permissions first. Done means the slim nginx container starts successfully under the generated AppArmor profile.