build: configure SELinux labels for Docker volumes #6055
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
When SELinux is enforced the mounted volumes to spun Docker containers are not writable unless the `:z` or `:Z` flag is set[1]. This opts not to share the mounts by using `:Z`. [1] https://docs.docker.com/storage/bind-mounts/#configure-the-selinux-label Fixes open-policy-agent#6054 Signed-off-by: Zoran Regvart <[email protected]>
✅ Deploy Preview for openpolicyagent ready!
To edit notification comments on pull requests, go to your Netlify site configuration. |
|
@zregvart thanks for the contribution. Have we verified this works on SELinux enabled and disabled systems? |
Thanks for the comment, I wanted to record a session with and without SELinux enforcement and I found two additional places that needed the labeling. I'll create a followup PR shortly. I also run Fedora Linux which has SELinux enforced by default, and I expect GitHub Linux worker nodes do not run with SELinux enforced. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Why the changes in this PR are needed?
When SELinux is enforced the mounted volumes to spun Docker containers are not writable unless the
:zor:Zflag is set[1].This opts not to share the mounts by using
:Z.What are the changes in this PR?
The
:Zflag is set for Docker volume mounts.Notes to assist PR review:
Fixes #6054
Further comments:
[1] https://docs.docker.com/storage/bind-mounts/#configure-the-selinux-label