[ECS] [Feature Request]: Enable `z` (lower case z) mounting option for ECS.
- Dominant language
- Shell
- Stars
- 5.4k
- Forks
- 334
- PR merge metrics
- No merged PRs in 30d
Description
### Community Note
* Please vote on this issue by adding a 👍 [reaction](https://blog.github.com/2016-03-10-add-reactions-to-pull-requests-issues-and-comments/) to the original issue to help the community and maintainers prioritize this request
* Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
* If you are interested in working on this issue or have submitted a pull request, please leave a comment
**Tell us about your request**
I'd like to enable `z` for ECS mounts to configure bind mount that is to be shared amongst multiple containers while utilizing SELinux:
[The z option indicates that the bind mount content is shared among multiple containers.](https://docs.docker.com/storage/bind-mounts/#configure-the-selinux-label)
**Which service(s) is this request for?**
Definitely ECS, EKS and Fargate as well if possible.
**Tell us about the problem you're trying to solve. What are you trying to do, and why is it hard?**
Currently there is no option to mount devices using `z`, only `Z`. This appears to be evident in the source at this line:
https://github.com/aws/amazon-ecs-agent/blob/71a0f6765cc469913a0b09728196feb0d0d33e37/agent/containermetadata/write_metadata_unix.go#L34
As per the docker run manpage:
```
The 'z' option tells Docker that the volume content will be shared between containers. Docker will
label the content with a shared content label. Shared volumes labels allow all
containers to read/write content. The 'Z' option tells Docker to label the
content with a private unshared label.
```
**Are you currently working around this issue?**
Not currently possible to use the `-z`
**Additional context**
This would be useful in utilizing resources that share volume content between containers. Likely for EFS as well, although there are additional concerns with SELinux and NFS (such as this [document](https://selinuxproject.org/page/Labeled_NFS)).
**Attachments**
If you think you might have additional information that you'd like to include via an attachment, please do - we'll take a look. (Remember to remove any personally-identifiable information.)
Contributor guide
Research direction
Start by reading agent/containermetadata/write_metadata_unix.go at the linked line to see how the existing Z mounting option is handled. Trace the related mount configuration and tests, if present, and determine what ECS, EKS, and Fargate support would cover. Done means the lowercase z shared-label option is accepted and verified without regressing the existing private-label behavior.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- docker
- Domain
- cloud, infrastructure
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100