docker: cannot mount /etc/localtime when using selinuxlabel
- Dominant language
- Go
- Stars
- 17k
- Forks
- 2.1k
- Avg merge
- 1d 9h
- Merged PRs (30d)
- 105
Description
This is the issue for that fix: https://github.com/hashicorp/nomad/pull/7094
### Nomad version
Nomad v0.11.0-beta2 (4cf0ac5533e50d1ceba056e0c88b890d4c6d6f5a)
### Operating system and Environment details
Everything is in this Vagrant project.
```
Linux node 4.18.0-80.el8.x86_64 #1 SMP Tue Jun 4 09:19:46 UTC 2019 x86_64 x86_64 x86_64 GNU/Linux
SELinux status: enabled
SELinuxfs mount: /sys/fs/selinux
SELinux root directory: /etc/selinux
Loaded policy name: targeted
Current mode: enforcing
Mode from config file: enforcing
Policy MLS status: enabled
Policy deny_unknown status: allowed
Memory protection checking: actual (secure)
Max kernel policy version: 31
```
### Issue
When SELinux is enabled on the Docker side, `/local` and `/secrets` don't have the labels, hence are unreadable.
Setting `selinuxlabel` makes then readable.
But it prevents from mounting non-relabelable volumes, such as `/etc/localtime`
### Reproduction steps
https://gitlab.com/greut/vagrant-nomad-selinux
### Job file (if appropriate)
```hcl
job "job" {
datacenters = ["dc1"]
type = "service"
group "group" {
task "task" {
driver = "docker"
config {
image = "python:3-slim"
args = [
"python", "-m", "http.server",
"--bind", "0.0.0.0",
"--directory", "/",
"80",
]
volumes = [
"/etc/localtime:/etc/localtime",
]
}
template {
data = < 2020-04-04T09:14:33.590Z [DEBUG] client.driver_mgr.docker: failed to start container: driver=docker container_id=752131b8c5a9a97f2157d65c19d9270739e74a03673c21f7388a82c3f1ebb004 attempt=3 error="API error (500
): error setting label on mount source '/usr/share/zoneinfo/UTC': relabeling content in /usr is not allowed"
Contributor guide
No contributing guide indexed for this repository
Research direction
Start with the linked pull request 7094 and the Vagrant reproduction project, then review Nomad's Docker driver handling of the provided job file and the client log showing the SELinux relabeling failure. Done means the reproduction no longer fails when /etc/localtime is mounted while selinuxlabel is used, while /local and /secrets remain readable.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- docker, go
- Domain
- devops
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 25/100