An AppArmor Stacking Incident Misdiagnosed as a Network Failure
Comments on “An AppArmor Stacking Incident Misdiagnosed as a Network Failure”
Claim-checked. Scored by all three judges, and its checkable claims were compared with the sources it cites. How far stories are checked
After upgrading four Ubuntu 26.04 nodes to kernel 7.0.0-42, one operator (E-Whisper's east4ming) saw database pods crash-loop while applications reported "no route to host." Tracing with perf, strace and bpftrace pointed to gosu spinning because AppArmor, using stacked labels, returned EPERM on in-container signals, mismatching containerd's CRI profile rules. Setting kernel.apparmor_restrict_unprivileged_unconfined=0 in a 90- sysctl file and recreating pods fixed it. The traces and experiments are the author's own and unverified; the kernel cause was not independently checked.
Why it ranked
No. 14 of 139 with a score of 0.67. The panel rated it highest on technical depth (0.94) and substantiated (0.88), lowest on audience breadth (0.49). Placed No. 14, No. 32 by score alone: the placement terms moved other stories past it.
- AI judgeJudge 2claude-haiku-5-5
- Detailed, well-evidenced debugging writeup of a real kernel/AppArmor regression affecting containerized databases; practically useful to infra builders, though narrow in audience and mostly about one homelab's incident.
- AI judgeJudge 3gpt-5.6-luna
- A detailed, evidence-backed postmortem of an Ubuntu/AppArmor/containerd regression, with reproducible diagnostics, controlled experiments, mitigation, persistence details, and operational tradeoffs. It is highly actionable for Kubernetes and Linux operators, though narrower than a field-wide development.
Each judge wrote its line after answering the rubric, with the site and the author still hidden. Every answer behind this is in the table under Score.
Score
0.67total under rubric v2.3
- Significance0.54
- Reader interest0.77
- Audience breadth0.49
- Practical relevance0.77
- Substantiated0.88
- Technical depth0.94
- New information0.85
- Counts against: Promotional0.02
- Counts against: Overclaim0.16
Each judge’s answer per question (0–1), their mean and spread, and what the question adds to the score (weight × mean).
| Question | Judge 1 | Judge 2 | Judge 3 | Mean | Spread | Weight | Contribution (weight times mean) |
|---|---|---|---|---|---|---|---|
| SignificanceHow much does this change what people in tech know or can do? | 0.53 | 0.42 | 0.68 | 0.54 | 0.26 | +0.24 | +0.130 |
| Reader interestWould a well-informed senior engineer or tech founder want to read this today, and likely pass it on? | 0.72 | 0.72 | 0.86 | 0.77 | 0.14 | +0.26 | +0.199 |
| Audience breadthHow many people who build technology does it concern? | 0.50 | 0.42 | 0.55 | 0.49 | 0.13 | +0.13 | +0.064 |
| Practical relevanceHow useful is it to someone who builds software or tech products? | 0.77 | 0.70 | 0.84 | 0.77 | 0.14 | +0.22 | +0.170 |
| SubstantiatedHow well is it backed? Consider whether it is the primary source, and whether its main claims come with data, code, a demo, a reproducible method or citations. | 0.97 | 0.80 | 0.88 | 0.88 | 0.17 | +0.05 | +0.044 |
| Technical depthHow technically substantive is it? | 1.00 | 0.90 | 0.91 | 0.94 | 0.10 | +0.05 | +0.047 |
| New informationDoes it contain information absent from the stories covered in the last 7 days (list provided)? | 0.86 | 0.70 | 0.98 | 0.85 | 0.28 | +0.05 | +0.042 |
| PromotionalIs it mainly marketing with little substance (a press release, ad or sponsored post with no real information)? A launch post that carries real news is not promotional. | 0.02 | 0.03 | 0.01 | 0.02 | 0.02 | −0.19 | −0.004 |
| OverclaimDo the headline or conclusions claim more than the body supports? | 0.21 | 0.20 | 0.08 | 0.16 | 0.13 | −0.11 | −0.018 |
| Sum of contributions | +0.674 | ||||||
| Claim-check penalty | 0.000 | ||||||
| Total, as published | 0.674 | ||||||
Spread is the highest minus the lowest judge answer. marks a spread above 0.40: the judges disagree, and the story is marked contested.
The badge for this ranking, for the author's page or anyone's: one line of HTML, and it links back here.
<a href="https://rubric.hrih.si/editions/2026-11-05/14/"><img src="https://rubric.hrih.si/badge/2026-11-05/14.svg" alt="Ranked #14 on Rubric, 5 Nov 2026" width="238" height="28"></a>Claim check
Claim check: 2 matches source · 4 no source given · 2 couldn’t check. Each claim is compared with the source the article itself cites; a flag is published only when both checkers agree.
No source givenVersion
Four Ubuntu 26.04 nodes were upgraded via apt, moving linux-image-generic from 7.0.0-38 to 7.0.0-42, and were then rebooted one by one.
The article gives no link or citation for it.
The article says “four Ubuntu 26.04 nodes finished apt upgrade, which moved linux-image-generic from 7.0.0-38 to 7.0.0-42”
The source says No source to compare with.
No source givenCausal conclusion
Go's AllThreadsSyscall broadcasts SIGSETXID to every thread so each completes setgid/setuid in sync, and if signal delivery fails the wait loop never exits.
The article gives no link or citation for it.
The article says “Go’s AllThreadsSyscall broadcasts SIGSETXID to every thread in the process, using that signal to make each thread complete setgid/setuid in sync”
The source says No source to compare with.
No source givenNumber
A bpftrace kretprobe on apparmor_task_kill showed gosu returning -13 (EPERM), with no signal_generate events.
The article gives no link or citation for it.
The article says “gosu’s return value was -13, i.e. EPERM, and there were no signal_generate events at all”
The source says No source to compare with.
Couldn’t checkCausal conclusion
With kernel 7.0.0-42 and the default kernel.apparmor_restrict_unprivileged_unconfined=1, container profile transitions changed to stacking, so any signal delivery inside a container returns EPERM.
The source was unreachable, paywalled or too long, or the two checkers disagreed.
The article says “With kernel 7.0.0-42 and the default sysctl parameter kernel.apparmor_restrict_unprivileged_unconfined=1, the way container profiles are transitioned was changed to stacking”
The source says No passage could be compared.
Source cited by the article: bugs.launchpad.net/ubuntu/+source/linux/+bug/2172422
Matches sourceCausal conclusion
containerd's CRI profile signal rules rely on exact label matching, which no longer matches once the label takes the stacked form.
The cited source says the same thing.
The article says “containerd’s CRI profile contains rules such as signal ... peer=cri-containerd.apparmor.d, which rely on exact label matching to allow signal delivery inside the container”
The source says “The default profile only allows `signal` and `ptrace` for the literal profile name, so processes in the same container cannot signal each other”
Source cited by the article: github.com/containerd/containerd/pull/14487
No source givenCausal conclusion
In a controlled experiment, gosu worked with privileged, Unconfined, capabilities ALL, or the sysctl set to 0, but still spun with only CHOWN added, so capabilities are not the cause.
The article gives no link or citation for it.
The article says “The fourth row shows this has nothing to do with capabilities”
The source says No source to compare with.
Matches sourceCausal conclusion
Ubuntu's /usr/lib/sysctl.d/10-apparmor.conf sorts earlier, so only a later-sorting 90- file can override it.
The cited source says the same thing.
The article says “Ubuntu’s own /usr/lib/sysctl.d/10-apparmor.conf sorts earlier, so only a 90- file that sorts later can override it”
The source says “If multiple files specify the same option, the entry in the file with the lexicographically latest name will take precedence”
Source cited by the article: freedesktop.org/software/systemd/man/latest/sysctl.d.html
Couldn’t checkGeneralization
The author says the problem is a regression in kernel 7.0.0-42/-43 where Go 1.24 programs livelock in setuid and official DB Docker images hang on start.
The source was unreachable, paywalled or too long, or the two checkers disagreed.
The article says “Regression 7.0.0-42/-43: Go 1.24 programs livelock in setuid (gosu); official DB Docker images hang on start”
The source says No passage could be compared.
Source cited by the article: bugs.launchpad.net/ubuntu/+source/linux/+bug/2172422
Also covered by
No other coverage was clustered with this story.
Elsewhere
Elsewhere: HN 1 pts, not on front page
Recorded for context only, checked 5 Nov 2026, 05:46 UTC. It played no part in the ranking.