How to fix Error response from daemon: error loading AppArmor profile in Docker

DockerINTERMEDIATEMEDIUMUpdated Dec 6, 2025· 271 views

This error occurs when Docker cannot load its default AppArmor security profile. The fix typically involves installing the apparmor package, restarting the AppArmor service, or running containers with AppArmor disabled.

Quick fix

Fixes Error response from daemon: error loading AppArmor profile

sudo aa-status
  1. Check if AppArmor is enabled on your system
  2. Install the AppArmor package
  3. Restart the AppArmor service
  4. Run container with AppArmor disabled (workaround)
docker — error
sudo aa-status
Error response from daemon: error loading AppArmor profile

What this error means

When Docker starts a container, it applies security profiles to restrict what the container can do on the host system. AppArmor (Application Armor) is a Linux security module that Docker uses by default on Ubuntu and Debian-based systems. Docker automatically generates and loads a profile called `docker-default` into the kernel. This profile restricts dangerous operations like mounting filesystems, accessing sensitive host paths, or using raw network sockets. When Docker cannot load this profile, it refuses to start containers to maintain security. This error commonly appears after upgrading Docker versions, when the `apparmor` package is missing, when Docker runs inside LXC/LXD containers, or when the AppArmor service has issues during boot.

Typical symptoms

  • Containers fail to start with 'error loading AppArmor profile' message
  • Docker commands work fine until you try to run a container
  • Error mentions 'docker-default profile could not be loaded'
  • apparmor_parser executable not found in PATH
  • The issue appeared after a Docker or system upgrade
  • Problem occurs specifically on Ubuntu, Debian, or other AppArmor-enabled systems

Common causes

  1. The apparmor package is not installed (most common on minimal systems)
  2. AppArmor service failed to start or load profiles during boot
  3. Docker upgraded to a new version that changed AppArmor handling
  4. Running Docker inside an LXC/LXD container without proper configuration
  5. The apparmor_parser binary is missing or not in PATH
  6. Corrupted AppArmor profile cache
  7. SELinux and AppArmor conflict (rare, on systems with both)

How to fix "Error response from daemon: error loading AppArmor profile"

1Check if AppArmor is enabled on your system

First, verify whether AppArmor is running and what profiles are loaded:

bash
sudo aa-status

If this command returns "apparmor module is not loaded", AppArmor may be disabled in your kernel. If the command is not found, the apparmor-utils package needs to be installed.

2Install the AppArmor package

On Debian/Ubuntu systems, install the required AppArmor packages:

bash
sudo apt update
sudo apt install apparmor apparmor-utils

After installation, restart Docker:

bash
sudo systemctl restart docker

Try running a container again to verify the fix.

3Restart the AppArmor service

If AppArmor is installed but profiles aren't loading, restart the service:

bash
sudo systemctl restart apparmor
sudo systemctl restart docker

Verify the profiles are now loaded:

bash
sudo aa-status | grep docker
4Run container with AppArmor disabled (workaround)

If you need containers running immediately while troubleshooting, you can disable AppArmor for specific containers:

bash
docker run --security-opt apparmor=unconfined -it alpine:latest

For Docker Compose, add to your service:

yaml
services:
  myservice:
    image: myimage
    security_opt:
      - apparmor:unconfined

Warning: This reduces container security. Use only as a temporary workaround.

5Reload Docker's default AppArmor profile manually

If the profile exists but isn't loaded, you can reload it manually:

bash
sudo apparmor_parser -r -W /etc/apparmor.d/docker

If the docker profile file doesn't exist, restart Docker to regenerate it:

bash
sudo systemctl restart docker

Then verify with:

bash
sudo aa-status | grep docker-default
6Fix boot order issues

Sometimes Docker starts before AppArmor finishes loading profiles. Ensure AppArmor starts before Docker:

bash
sudo systemctl enable apparmor
sudo systemctl restart apparmor
sudo systemctl restart docker

You can check the boot order with:

bash
systemctl list-dependencies docker.service

Advanced notes

### Running Docker Inside LXC/LXD Containers

When running Docker inside LXC/LXD containers, the nested AppArmor profiles can conflict. You have several options:

1. Uninstall AppArmor from the inner container (not the host):

bash
sudo apt remove apparmor

2. Configure the LXC container for nesting:

bash
lxc config set <container> security.nesting true

3. Relax AppArmor restrictions for container-base:

bash
sudo sed -i.old '/deny \/sys/ s/^/#/g' /etc/apparmor.d/abstractions/lxc/container-base
sudo apparmor_parser -r /etc/apparmor.d/lxc-containers

### Docker Version Upgrade Issues

Docker version 23.0.0 changed how AppArmor profiles are handled. If you upgraded from 20.10.x to 23.x, you may need to:

1. Reinstall the apparmor packages
2. Clear Docker's cached state: sudo rm -rf /var/lib/docker/tmp/*
3. Restart both services

### Debugging AppArmor Denials

Check system logs for AppArmor denials:

bash
sudo dmesg | grep apparmor
sudo journalctl -k | grep apparmor

For detailed audit messages:

bash
sudo ausearch -m AVC,USER_AVC -ts recent | grep docker

### Permanently Disabling AppArmor for Docker

If AppArmor is causing persistent issues and you understand the security implications, you can disable it:

bash
sudo aa-disable /etc/apparmor.d/docker

Or add to Docker daemon configuration (/etc/docker/daemon.json):

json
{
  "security-opts": ["apparmor=unconfined"]
}

Note: This reduces container isolation security. Consider rootless Docker as an alternative.

### Ubuntu 24.04+ Considerations

Ubuntu 24.04 enables restricted unprivileged user namespaces by default. If using rootless Docker, ensure you have the docker-ce-rootless-extras package installed, which includes the necessary AppArmor profile for rootlesskit.

Frequently asked questions

What does "Error response from daemon: error loading AppArmor profile" mean?
When Docker starts a container, it applies security profiles to restrict what the container can do on the host system. AppArmor (Application Armor) is a Linux security module that Docker uses by default on Ubuntu and Debian-based systems. Docker automatically generates and loads a profile called docker-default into the kernel.
How do I fix "Error response from daemon: error loading AppArmor profile"?
This error occurs when Docker cannot load its default AppArmor security profile. The fix typically involves installing the apparmor package, restarting the AppArmor service, or running containers with AppArmor disabled.
What causes "Error response from daemon: error loading AppArmor profile"?
The apparmor package is not installed (most common on minimal systems) AppArmor service failed to start or load profiles during boot Docker upgraded to a new version that changed AppArmor handling
Is the "Error response from daemon: error loading AppArmor profile" error serious?
It is a medium-severity error — more of a blocker than a risk. The steps above resolve it.

Official resources & further reading