$ lxc config set test-v240 raw.apparmor 'mount options=(ro,nodev,remount,bind),
mount options=(ro,nosuid,nodev,remount,bind),
mount options=(ro,nosuid,noexec,remount,strictatime),
mount options=(ro,nosuid,noexec,remount,bind,strictatime),
mount options=(ro,nosuid,nodev,noexec,remount,bind),'
Actually more is needed:
$ lxc config set test-v240 raw.apparmor 'mount options= (ro,nodev, remount, bind), (ro,nosuid, nodev,remount, bind), (ro,nosuid, noexec, remount, strictatime) , (ro,nosuid, noexec, remount, bind,strictatim e), (ro,nosuid, nodev,noexec, remount, bind),'
mount options=
mount options=
mount options=
mount options=