Docker inside LXC container gives AppArmor error

Around November 10 ago suddenly none of my docker containers worked (previously happily running inside an unpriviliged Proxmox LXC). I was not the only one:

• Docker inside LXC (net.ipv4.ip_unprivileged_port_start error) (proxmox.com)
• fd reopening causes issues with AppArmor profiles with nested docker (proxmox.com)
• Impossible to run docker (reddit.com)

The temporary fix was to downgrade the containerd.io package and apt-mark hold it:

sudo apt install containerd.io=1.7.28-1~debian.12~bookworm
sudo apt-mark hold containerd.io
sudo systemctl restart docker
sudo docker ps -a

The final fix was to wait, then un-hold the package and upgrade:

sudo apt-mark unhold containerd.io
sudo apt upgrade

Version 2.2.1-1~debian.12~bookworm seems to work for me. Proxmox 9.1 should also have received an update.