OK more information before I give up :) The sequence of steps is this - Apparmor is initially stopped - Disable ping, dnsmasq, lxc-start - Start apparmor - All is good - Disable haproxy - Restart apparmor - haproxy profile is still loaded - Run apparmor_parser -R /etc/apparmor.d/usr.sbin.haproxy - haproxy is now unloaded