umount -a tries to unmount everything in /etc/mtab — including /sys/kernel/security. systemd mounts securityfs exactly once, in PID 1’s mount_setup(): there’s no unit to restart.

Without it, libapparmor can’t find /sys/kernel/security/apparmor and fails:

aa_is_enabled() failed unexpectedly (No such file or directory): No such file or directory

And then every snap-packaged binary stops — including docker and dockerd, because the AppArmor confinement can’t be resolved. No systemctl start fixes it; only a reboot remounts securityfs.

Always unmount by name: sudo umount /specific/mountpoint.