fix(docker): add SELinux volume relabeling for RHEL/Fedora hosts#342
Open
Alexi5000 wants to merge 1 commit into
Open
fix(docker): add SELinux volume relabeling for RHEL/Fedora hosts#342Alexi5000 wants to merge 1 commit into
Alexi5000 wants to merge 1 commit into
Conversation
Fixes KeygraphHQ#289 On Linux hosts with SELinux enforcing mode, bind mounts fail silently because the container process lacks the correct security label to access mounted paths. Adds automatic detection of SELinux enforcing mode via getenforce and appends :z (shared relabeling) to all bind-mount volume strings. Uses :ro,z for read-only mounts. The shared :z label is appropriate because multiple worker containers may access the same workspace concurrently. No effect on macOS, Windows, or Linux hosts with SELinux disabled.
Alexi5000
force-pushed
the
pr/fix-selinux-volume-mounts
branch
from
355fe72 to
bc5069d
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Addresses #288 (SELinux host startup/runtime failures — worker bind mounts).
On Linux hosts with SELinux enforcing mode, bind mounts fail silently because the container process lacks the correct security label to access mounted paths. The mount succeeds but access is denied at runtime.
Changes
The shared :z label is used rather than :Z because multiple worker containers may access the same workspace directory concurrently.
Test plan