#For proxmox (lxc) containers a custom apparmor rule must be created an used

# turn off the ct that you want to setup

#contents of custom rule :/etc/apparmor.d/lxc/lxc-custom-dovecot

profile lxc-container-custom-dovecot flags=(attach_disconnected,mediate_deleted) {
  #include <abstractions/lxc/container-base>
  #include <abstractions/lxc/start-container>
  deny mount fstype=devpts,
  mount fstype=cgroup -> /sys/fs/cgroup/**,
  mount fstype=cgroup2 -> /sys/fs/cgroup/**,
  mount options=(rw, bind, ro),
  mount options=(rw, rbind),
  mount options=(rw, rshared),
  mount options=(rw, bind),
  mount options=(ro, remount, noatime, bind),
  mount options=(ro, nosuid, noexec, remount, bind, strictatime),
}
#end of contents 
systemctl reload apparmor
echo "lxc.apparmor.profile: lxc-container-custom-dovecot" >> /etc/pve/lxc/<ctid>.conf
#start the container
# if dovecot does not work after continuing ins-instructions.txt please check dsmesg for apparmor="DENIED"