An AppArmor Stacking Incident Misdiagnosed as a Network Failure

After upgrading four Ubuntu 26.04 nodes to kernel 7.0.0-42, one operator (E-Whisper's east4ming) saw database pods crash-loop while applications reported "no route to host." Tracing with perf, strace and bpftrace pointed to gosu spinning because AppArmor, using stacked labels, returned EPERM on in-container signals, mismatching containerd's CRI profile rules. Setting kernel.apparmor_restrict_unprivileged_unconfined=0 in a 90- sysctl file and recreating pods fixed it. The traces and experiments are the author's own and unverified; the kernel cause was not independently checked.