In Ubuntu Server environments, apport is the core service responsible for intercepting application crashes, generating core dumps, and formatting bug reports. In a clustered or containerized architecture (like LXC/LXD or Docker running on Ubuntu), crash reports generated inside a container are often useless because the container lacks the system context or network routing to submit them. To solve this, Ubuntu uses the apport-forward.service, which explicitly forwards crash dumps from isolated containers back to the host OS’s Apport daemon for processing. However, in strictly managed, air-gapped data centers, or environments where crash telemetry is explicitly forbidden due to the risk of memory dumps containing sensitive cryptographic keys, apport-forward represents a severe security liability and unnecessary overhead.
This guide explains how to completely disable the apport-forward service in Ubuntu Server, ensuring that containerized crashes remain isolated and are never forwarded to the host.
Stop and Disable the Apport-Forward Service
To prevent the host OS from listening for or processing forwarded core dumps via the local socket, we must stop the service and remove its boot targets.
- Log into your Ubuntu Server via SSH using an account with
sudoprivileges. - First, check if the forwarding service is currently active:
sudo systemctl status apport-forward.socket - If it is active, stop the socket immediately, severing the connection bridge for containers:
sudo systemctl stop apport-forward.socket - Next, disable the socket to prevent it from initializing on the next boot:
sudo systemctl disable apport-forward.socket - For absolute certainty, explicitly mask both the socket and the associated service to prevent any other dependent systemd target from invoking them:
sudo systemctl mask apport-forward.socket apport-forward.service
Verify the Service Lockdown
By masking both the apport-forward.socket and the apport-forward.service, you guarantee that the host kernel will refuse to route container crash dumps into the host’s memory space, dropping them immediately.
To verify the lockdown is successful, attempt to start the socket manually:
sudo systemctl start apport-forward.socketSystemd will return a fatal error stating that the unit is masked (e.g., Failed to start apport-forward.socket: Unit apport-forward.socket is masked). Container crashes will now fail silently within their own namespaces, completely securing the host OS from receiving potentially sensitive, unencrypted core memory dumps.