aws / aws/containers-roadmap

[ECS] [Feature Request]: Enable `z` (lower case z) mounting option for ECS.

Open
#1,857 3 comments 2 reactions 0 assignees View on GitHub
ECS Proposed
Dominant language
Shell
Stars
5.4k
Forks
334
PR merge metrics
No merged PRs in 30d

Description

### Community Note

* Please vote on this issue by adding a 👍 [reaction](https://blog.github.com/2016-03-10-add-reactions-to-pull-requests-issues-and-comments/) to the original issue to help the community and maintainers prioritize this request
* Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
* If you are interested in working on this issue or have submitted a pull request, please leave a comment

**Tell us about your request**
I'd like to enable `z` for ECS mounts to configure bind mount that is to be shared amongst multiple containers while utilizing SELinux:
[The z option indicates that the bind mount content is shared among multiple containers.](https://docs.docker.com/storage/bind-mounts/#configure-the-selinux-label)

**Which service(s) is this request for?**
Definitely ECS, EKS and Fargate as well if possible.

**Tell us about the problem you're trying to solve. What are you trying to do, and why is it hard?**
Currently there is no option to mount devices using `z`, only `Z`. This appears to be evident in the source at this line:
https://github.com/aws/amazon-ecs-agent/blob/71a0f6765cc469913a0b09728196feb0d0d33e37/agent/containermetadata/write_metadata_unix.go#L34

As per the docker run manpage:
```
The 'z' option tells Docker that the volume content will be shared between containers. Docker will
label the content with a shared content label. Shared volumes labels allow all
containers to read/write content. The 'Z' option tells Docker to label the
content with a private unshared label.
```
**Are you currently working around this issue?**
Not currently possible to use the `-z`

**Additional context**
This would be useful in utilizing resources that share volume content between containers. Likely for EFS as well, although there are additional concerns with SELinux and NFS (such as this [document](https://selinuxproject.org/page/Labeled_NFS)).

**Attachments**
If you think you might have additional information that you'd like to include via an attachment, please do - we'll take a look. (Remember to remove any personally-identifiable information.)

Contributor guide

Open the contributing guide

Research direction

Start by reading agent/containermetadata/write_metadata_unix.go at the linked line to see how the existing Z mounting option is handled. Trace the related mount configuration and tests, if present, and determine what ECS, EKS, and Fargate support would cover. Done means the lowercase z shared-label option is accepted and verified without regressing the existing private-label behavior.

Written by the indexing model from the issue text.

Assessment

Tech stack
docker
Domain
cloud, infrastructure
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.