[ECS] [request]: Allow custom seccomp profile or label=disable flag for rootless Podman in Fargate
- Dominant language
- Shell
- Stars
- 5.4k
- Forks
- 334
- PR merge metrics
- No merged PRs in 30d
Description
### Community Note
* Please vote on this issue by adding a 👍 [reaction](https://blog.github.com/2016-03-10-add-reactions-to-pull-requests-issues-and-comments/) to the original issue to help the community and maintainers prioritize this request
* Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
* If you are interested in working on this issue or have submitted a pull request, please leave a comment
**Tell us about your request**
Allow custom seccomp profile or label=disable flag for rootless Podman in Fargate.
**Which service(s) is this request for?**
ECS on Fargate
**Tell us about the problem you're trying to solve. What are you trying to do, and why is it hard?**
It is not possible to run rootless Podman in ECS on Fargate as SELINUX blocks certain system calls and it is not possible to override [docker security options](https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_ContainerDefinition.html#ECS-Type-ContainerDefinition-dockerSecurityOptions) when running ECS on Fargate.
Note that we use ECS as a Jenkins build farm and as part of this workflow, we need to be able to build and push images, and run Testcontainers.
Please allow disabling SELINUX in ECS on Fargate via `--security-opt label=disable` or provide `--security-opt seccomp=podman.json` profile which works with rootless podman.
**Are you currently working around this issue?**
The only workaround is to run ECS on EC2 which is undesirable.
We could also use AWS CodeBuild which supports docker but this means that we have to rewrite all Jenkins pipelines which will take a lot of effort.
I am not sure if EKS on Fargate allows disabling of SELINUX?
**Additional context**
For testing I used below command locally:
`podman run --user=podman quay.io/podman/stable podman run docker.io/library/redis`
When running above container as an ECS task, below error is observed:
```
cannot clone : Operation not permitted
Error: cannot re-exec process
```
**Attachments**
N/A
Contributor guide
Research direction
No repository file, test, or implementation entry point is identified. Start with the ECS ContainerDefinition dockerSecurityOptions reference and the reported rootless Podman command, then determine whether this roadmap request has an applicable implementation path. Done would require the requested security configuration to support the described rootless Podman, image-build, and Testcontainers workflow on Fargate.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, docker
- Domain
- cloud, infrastructure
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 25/100