Add loop device in Proxmox container

Add Apparmor file for container

root@pve:~# cat /etc/apparmor.d/lxc/lxc-container-default-cgns-with-mounting
# Do not load this file.  Rather, load /etc/apparmor.d/lxc-containers, which
# will source all profiles under /etc/apparmor.d/lxc
#
# This profile is a combination of lxc-container-default-cgns and
# lxc-container-default-with-mounting and other options to allow SAMBA and
# iso9660 mounts.

profile lxc-container-default-cgns-with-mounting flags=(attach_disconnected,mediate_deleted) {
  #include <abstractions/lxc/container-base>

# From pofile lxc-container-default-cgns:
  # the container may never be allowed to mount devpts.  If it does, it
  # will remount the host's devpts.  We could allow it to do it with
  # the newinstance option (but, right now, we don't).
  deny mount fstype=devpts,
  mount fstype=cgroup -> /sys/fs/cgroup/**,
  mount fstype=cgroup2 -> /sys/fs/cgroup/**,

# From pofile lxc-container-default-with-mounting:
  # allow standard blockdevtypes.
  # The concern here is in-kernel superblock parsers bringing down the
  # host with bad data.  However, we continue to disallow proc, sys, securityfs,
  # etc to nonstandard locations.
  mount fstype=ext*,
  mount fstype=xfs,
  mount fstype=btrfs,

# Allow SAMBA mounts:
  mount fstype=cifs,

# Allow iso9660 mounts:
  mount fstype=iso9660,
}

Edit conteiner config file

root@pve:~# cat /etc/pve/lxc/100.conf
lxc.apparmor.profile: lxc-container-default-cgns-with-mounting
lxc.cgroup2.devices.allow: b 7:* rwm
lxc.cgroup2.devices.allow: c 10:237 rwm
lxc.mount.entry: /dev/loop0 dev/loop0 none bind,create=file 0 0
lxc.mount.entry: /dev/loop1 dev/loop1 none bind,create=file 0 0
lxc.mount.entry: /dev/loop2 dev/loop2 none bind,create=file 0 0
lxc.mount.entry: /dev/loop3 dev/loop3 none bind,create=file 0 0
lxc.mount.entry: /dev/loop4 dev/loop4 none bind,create=file 0 0
lxc.mount.entry: /dev/loop5 dev/loop5 none bind,create=file 0 0
lxc.mount.entry: /dev/loop6 dev/loop6 none bind,create=file 0 0
lxc.mount.entry: /dev/loop-control dev/loop-control none bind,create=file 0 0

Interactive run container in debug mode vith logging

lxc-start -n 109 -F -l DEBUG -o /tmp/lxc-ID.log

Note:

1. If not work delete string “unprivileged: 1” from lxc config file
2. Actual for Proxmox 7