As encountered on the latest LTS (24.04); see https://ubuntu.com/blog/ubuntu-23-10-restricted-unprivileged-user-namespaces Can be disabled using sysctl: ``` kernel.apparmor_restrict_unprivileged_unconfined=0 kernel.apparmor_restrict_unprivileged_userns=0 ``` I haven't considered the alternative, e.g., using an AppArmor profile.