Issues Apparmor Ubuntu 25.04

[danst0]

This also happens for my deluge container since the host was upgraded to 25.04. Any good way to circumvent this w/o killing app armor:

[peely]

I had the exact same issue, at least I assume it was exactly the same as you did not explain the issue. I've been tearing my hair out for a day, so thank you for raising this and sharing the stack overflow link. The answer didn't work for me, I think because the answer is about WireGuard on the host and our problem is WireGuard inside a docker container, but it gave me enough context to find my solution.

Create a file at /etc/apparmor.d/wg-quick-fix, with the content

profile wg-quick flags=(attach_disconnected) {
    file,
    capability,
    network,
    signal,
    ptrace,
    unix,
    /usr/sbin/wg-quick ix,
    /config/wireguard/wg0.conf ix,
}

I forget if I restart my host. But, once I made this change, I WireGuard inside the container could read the config file it was creating and all was fine!

To explain the issue I saw a little further, when trying to bring the container up on an Ubuntu 25.10 host, it would create a file at /config/wireguard/wg0.conf and then immediately throw an error saying it couldn't read the file, permission denied. My host would simultaneously log (tail -f /var/log/syslog)

[``521204.480191] audit: type=1400 audit(1769881953.192:25593): apparmor="DENIED" operation="open" class="file" profile="wg-quick" name="/config/wireguard/wg0.conf" pid=1667822 comm="wg-quick" requested_mask="r" denied_mask="r" fsuid=0 ouid=0