title: can't get container to take apparmor profile in k8s
body: <pre><code>mount: tmpfs is write-protected, mounting read-only
  mount: cannot mount tmpfs read-only
  failed.
  </code></pre>
  
  <p>basedon documentation re: annotations, and the <a href="https://github.com/pducharme/UniFi-Video-Controller" rel="nofollow noreferrer">containers creator</a>, here is the relevant part of my deployment file:</p>
  
  <pre><code>apiVersion: extensions/v1beta1
  kind: Deployment
  metadata:
    name: unifi-video
    annotations:
      container.apparmor.security.beta.kubernetes.io/unifi-video: "unconfined"
  spec:
    replicas: 1
    template:
      metadata:
        labels:
          app: unifi-video
      spec:
        hostname: unifi-video
        nodeSelector:
          kubernetes.io/hostname: mira-b.home
        volumes:
        - name: dockerdata
          persistentVolumeClaim:
            claimName: dockerdata-nas
        - name: cameradata
          persistentVolumeClaim:
            claimName: cameras-nas
        containers:
        - name: unifi-video
          image: pducharme/unifi-video-controller:3.9.7
          securityContext:
            capabilities:
              add:
                - SYS_ADMIN
                - DAC_READ_SEARCH
  </code></pre>
  
  <p>IT specifically calls out </p>
  
  <blockquote>
    <p>If you get this tmpfs mount error, add --security-opt apparmor:unconfined \ to your list of run options. This error has been seen on Ubuntu, but may occur on other platforms as well.</p>
  </blockquote>
  
  <p>but from what I can find (over an hour googling now), the way to achieve this is k8s is via the annotation line.  </p>
  
  <p>Am i missing something?</p>