Cannot use volume and volume_mount when SELinux is set to enforcing.

[jdoss]

It seems that I can't mount any kind of directory with the CSI hostpath plugin using volume and volume_mount directives.

group "victoriametrics" {
    count = 1

    restart {
      attempts = 10
      interval = "5m"
      delay = "25s"
      mode = "delay"
    }

    network {
      port "http" {
        to = 8428
      }
    }

    service {
      name = "victoriametrics"
      tags = ["metrics", "victoriametrics"]
      meta {
        nomad_alloc_id = "${NOMAD_SHORT_ALLOC_ID}"
        }
      provider = "consul"
      port = "http"
    }

    service {
      name = "influxdb"
      tags = ["metrics", "influxdb"]
      meta {
        nomad_alloc_id = "${NOMAD_SHORT_ALLOC_ID}"
        }
      provider = "consul"
      port = "http"
    }

    volume "victoriametrics" {
      type      = "csi"
      source    = "victoriametrics"
      read_only = false
      attachment_mode = "file-system"
      access_mode     = "single-node-writer"
    }

    task "http" {
      driver = "podman"

      volume_mount {
        volume      = "victoriametrics"
        destination = "/victoria-metrics-data"
        read_only   = false
      }

      config {
        image = "docker.io/victoriametrics/victoria-metrics:v1.79.0"
        ports = ["http"]

        # volumes = [
        #   "/opt/nomad/storage/victoria-metrics-data:/victoria-metrics-data:z"
        # ]
      }

      resources {
        cpu    = 600 # MHz
        memory = 768 # MB
      }
    }

With the above config the allocation fails over and over again. Disabling SELinux client node wide (something I'd like to avoid) or manually adding container_file_t to /opt/nomad/data/ (which is effectively :z on a volume mount) to my nomad data directory works around the issue.

# chcon system_u:object_r:container_file_t:s0 /opt/nomad/data/ -R

I believe this is related to the bigger conversation in hashicorp/nomad#9123 but maybe #139 could get merged so I could use security_opt = ["label=disable"] as a stop gap to disable SELinux on my container workloads that need persistent storage.

Ideally, it would be cool to just add selinuxlabel = "z" to volume_mount blocks so we can handle SELinux labeling:

volume_mount {
        volume      = "victoriametrics"
        destination = "/victoria-metrics-data"
        read_only   = false
        selinuxlabel = "z"
      }

on a per mount basis or inherit selinuxlabel = "z" from

plugin "nomad-driver-podman" {
          config {
            volumes {
              enabled      = true
              selinuxlabel = "z"
            }
          }
        }