title: What does lxc-container-default-with-nesting AppArmor profile do?
body: <p>I'm using nested LXC with lxc-container-default-with-nesting profile which looks like the following.</p>
  
  <pre><code>profile lxc-container-default-with-nesting flags=(attach_disconnected,mediate_deleted) {
    #include &lt;abstractions/lxc/container-base&gt;
    #include &lt;abstractions/lxc/start-container&gt;
  
  #  Uncomment the line below if you are not using cgmanager
  #  mount fstype=cgroup -&gt; /sys/fs/cgroup/**,
  
    deny /dev/.lxc/proc/** rw,
    deny /dev/.lxc/sys/** rw,
    mount fstype=proc -&gt; /var/cache/lxc/**,
    mount fstype=sysfs -&gt; /var/cache/lxc/**,
    mount options=(rw,bind),
  }
  </code></pre>
  
  <p>and I have two questions about the following line.</p>
  
  <pre><code>  mount fstype=proc -&gt; /var/cache/lxc/**,
  </code></pre>
  
  <ol>
  <li><p>Why is it safe to allow container to mount /proc ?</p></li>
  <li><p>Why container needs to mount /proc under /var/cache/lxc ?</p></li>
  </ol>