GitHub Actions · Ubuntu 26.04 · Checked November 4, 2026

Postgres never starts in Docker on Ubuntu 26.04: "docker-default//&unconfined"

An AppArmor fix in the Linux kernel (08c2f7c8d4b1, "apparmor: fix unconfined user namespace restriction forced stack") has reached Ubuntu 26.04's newer kernels and Debian 13's 6.12.115. Ubuntu turns on kernel.apparmor_restrict_unprivileged_unconfined=1 by default, and with it the kernel now stacks the container's profile: processes run as docker-default//&unconfined instead of docker-default. Docker's default profile only lets a process signal peers named docker-default, so the processes of one container can no longer signal each other (moby #54099, open).

What it looks like

The official postgres or mariadb image starts and writes nothing. gosu in the entrypoint spins at 100% CPU. In a workflow, a service container with a health check never becomes healthy, and the job ends with Service container postgres failed., an empty log, Failed to initialize container postgres:17 and One or more containers failed to start.
Without gosu: pg_ctl: could not send stop signal (PID: 47): Permission denied, or could not signal for checkpoint: Permission denied.
Node.js in a docker build step: Error: kill EACCES when Next.js stops its build workers (runs-on #116).
In the host's kernel log: apparmor="DENIED" operation="signal" ... profile="docker-default" comm="gosu" ... peer="docker-default//&unconfined".

gosu is written in Go, and Go changes the user of every thread by sending each one a signal. When that signal is denied, it waits forever, which is why the container hangs instead of failing.

Where it was reported

Ubuntu 26.04 on 7.0.0-42-generic (a VMware VM, in moby #54099) and 7.0.0-1016-aws (runs-on's November 2 images; the October 21 images on 7.0.0-1014-aws were fine). A k3s cluster went down when its workers rebooted from 7.0.0-38 into 7.0.0-42 (seichi_infra #6671).
Debian 13 after a kernel update from 6.12.113 to 6.12.115 (a comment on moby #54099).
containerd and Kubernetes have the same rule in their default profile (containerd #14485).

So in GitHub Actions this hits self-hosted runners and third-party runner images that boot one of these kernels. GitHub-hosted runners (image 20261026, kernel 7.0.0-1017-azure on both ubuntu-24.04 and ubuntu-26.04) had no reports as of November 4.

Check a host

uname -r
sysctl kernel.apparmor_restrict_unprivileged_unconfined
docker run --rm busybox:1.36 sh -c 'cat /proc/self/attr/current; sleep 30 & kill -TERM $! && echo SIGNAL_OK || echo SIGNAL_DENIED'

An affected host prints docker-default//&unconfined (enforce) and SIGNAL_DENIED.

Fix for one container: no AppArmor profile

services:
  postgres:
    image: postgres:17
    options: >-
      --security-opt apparmor=unconfined
      --health-cmd pg_isready
      --health-interval 5s

Outside a workflow it is docker run --security-opt apparmor=unconfined. The same option works under container: for a job container. It leaves the host alone and takes AppArmor off that container only. --security-opt seccomp=unconfined does not help, because seccomp is not what denies the signal.

Fix for the host: the sysctl

echo 'kernel.apparmor_restrict_unprivileged_unconfined = 0' | sudo tee /etc/sysctl.d/99-container-signals.conf
sudo sysctl --system

Containers keep docker-default and can signal each other again. On runs-on, one user put the same sysctl in the image's preinstall step and their builds passed (runs-on #116). This turns off a restriction Ubuntu enables on purpose, so prefer the per-container option where you can.

Other ways out

containerd and Kubernetes: a pull request adds peer=<profile>//&* to the signal and ptrace rules of the default profile (containerd #14487, open). Some operators load that profile on their nodes themselves; appArmorProfile: {type: Unconfined} in the pod's security context is the per-pod way out.
Boot the previous kernel and hold it (7.0.0-38 on Ubuntu 26.04). That is only for a few days: the later kernels carry security fixes.

Telling it apart

bash -c 'echo ok' in the same image works, and gosu postgres id hangs: it is this.
A sandbox inside bwrap failing with "No permissions to create a new namespace" is a different AppArmor profile, bwrap-userns-restrict (bubblewrap on Ubuntu 26.04).
A service container that fails the same way on every kernel is usually its health check or its environment variables. Look at the log in the "Service container ... failed" group: an empty log points here.

Other 26.04 failures

"Error: write EINVAL" from every WebdriverIO worker on Ubuntu 26.04: v9 starts workers through xvfb-run, and the 26.04 one does not pass on the IPC channel; fixed in 9.33.1, which npm's latest tag does not point to yet.
"version `GLIBC_2.43' not found" after building on Ubuntu 26.04: glibc is 2.43, so binaries built there can need GLIBC_2.42 or GLIBC_2.43 and fail to start on Ubuntu 24.04, Debian 13 and older; build releases on an older image and check the floor in CI.
bubblewrap on Ubuntu 26.04: a sandbox inside bwrap fails under AppArmor's bwrap-userns-restrict.
"client version ... is too old" on Ubuntu 26.04: Docker 29 refuses clients below API 1.40, so older Testcontainers fails with "Could not find a valid Docker environment".
apt on Ubuntu 26.04: renamed and removed packages.
"coreutils: unknown program": most core tools are uutils.

See failed jobs from IntelliJ IDEA

Pipeline Inbox for GitHub Actions Workflows, a plugin by Lesstep for JetBrains IDEs 2024.1 or later, lists the runs of all your repositories in an IDE tool window, with their jobs and steps, and your current branch's runs are in the status bar. Reading is free; re-running failed jobs, cancelling, running workflows and reviewing deployments are Pro (US$1.50 a month, with a 30-day trial).

Get it on JetBrains Marketplace

GitHub and GitHub Actions are trademarks of GitHub, Inc.; Ubuntu is a trademark of Canonical Ltd.; Debian is a registered trademark of Software in the Public Interest, Inc.; Docker is a trademark of Docker, Inc.; PostgreSQL is a registered trademark of the PostgreSQL Community Association; IntelliJ IDEA is a trademark of JetBrains s.r.o. This page is not affiliated with, sponsored or endorsed by GitHub, Inc., Canonical, Software in the Public Interest, Docker, Inc., the PostgreSQL project or JetBrains.

More: "The ubuntu-latest label will migrate to Ubuntu 26" · bubblewrap on Ubuntu 26.04 · GitHub Actions plugins for IntelliJ IDEA compared · 日本語