SEC: Add :z/:Z to mounted volumes in {local,production}.yml

[westurner]

Description

Add :z or :Z suffixes to volumes in the local.yml and production.yml docker-compose configuration files.

Rationale

Without these in local.yml, I was getting the following errors:

$ docker-compose -f local.yml up
[...]
django          | python: can't open file 'manage.py': [Errno 13] Permission denied
flower          | Unable to load celery application.
flower          | The module config was not found.
node            | Error: EACCES: permission denied, scandir '/app'

I've only cursorily tested that the modifications to local.yml do seem to work; I see the index page and the django-debug-toolbar sidebar when I navigate to http://localhost:8000/

• (Have someone else?) test these modifications to production.yml
• Get feedback on whether relabeling is the only way to make this work on a platform with SELinux enabled (e.g. Fedora, CentOS, RHEL, SUSE)
• Verify that :z and :Z are silently ignored on non-selinux platforms
• Reference the docs:
  • https://docs.docker.com/compose/compose-file/#volumes
  • https://docs.docker.com/storage/volumes/
  • https://danwalsh.livejournal.com/76016.html

    :z will relabel with a shared label so other containers ran read and write the volume.
    :Z will relabel with a private label so that only this specific container can read and write the volume.

• Should production_postgres_data_backups:/backups:z be :z or :Z?

Use case(s) / visualization(s)

• Users developing in docker containers on systems with SELinux in enforcing mode (Fedora, CentOS, RHEL, SUSE)
• Users deploying to production with docker on systems with SELinux in enforcing mode (Fedora, CentOS, RHEL, SUSE)

[browniebroke]

Tried on macOS, and it seems to work. Would be nice if someone on Windows could confirm that it doesn't break anything.

[browniebroke]

Ok let's try this. Let's keep an eye on issues reported from Windows users in the coming days.

Thank you for your contribution! 🎉

[westurner]

Thanks!

…

On Mon, Sep 7, 2020, 8:53 AM Bruno Alla ***@***.***> wrote: Ok let's try this. Let's keep an eye on issues reported from Windows users in the coming days. Thank you for your contribution! 🎉 — You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub <#2663 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAAMNS7TITJC4P4HI6QJCULSETJTVANCNFSM4OR7QXGQ> .

[professorhaseeb]

Ok let's try this. Let's keep an eye on issues reported from Windows users in the coming days.

Thank you for your contribution! 🎉

Works properly on windows 👍