The used profile is derived from what LXD uses to confine its containers. See https://github.com/lxc/lxd/blob/master/lxd/apparmor.go