Rootful Podman restarts a --uidmap container once on an AppArmor host, then gives up

TL;DR: On a host with AppArmor enabled, a rootful Podman container that has its own ID mapping...