Self-hosting guides: binary fails to start under SELinux after moving it to /usr/local/bin

Pages affected

• https://www.meilisearch.com/docs/resources/self_hosting/deployment/running_production
• https://www.meilisearch.com/docs/resources/self_hosting/deployment/aws
• https://www.meilisearch.com/docs/resources/self_hosting/deployment/gcp
• https://www.meilisearch.com/docs/resources/self_hosting/deployment/digitalocean

What happens

All four production deployment guides tell the user to download the binary with the install script and then move it:

mv ./meilisearch /usr/local/bin/

On a distribution that runs SELinux in enforcing mode (Fedora, RHEL, Rocky Linux, AlmaLinux, CentOS Stream), mv preserves the SELinux context of the source directory instead of relabeling the file for its new location. The binary ends up in /usr/local/bin still labeled with the context of the home directory it was downloaded into, for example unconfined_u:object_r:user_home_t:s0 instead of system_u:object_r:bin_t:s0.

Everything up to step 4 looks fine. The service then fails to start:

systemctl status meilisearch

Failed at step EXEC spawning /usr/local/bin/meilisearch: Permission denied

This is confusing because the file permissions and the ownership set in step 2 (chown meilisearch:meilisearch /usr/local/bin/meilisearch) are correct. chown does not touch the SELinux label, so following the guide exactly still leaves a service that will not start.

Fix

Relabeling the file resolves it:

restorecon -v /usr/local/bin/meilisearch

The label can be verified with:

ls -Z /usr/local/bin/meilisearch

Proposal

Add a short note right after the mv step on each of the four guides, naming the affected distributions, showing the error message so people searching for it land on the page, and giving the restorecon command.

I am happy to open a PR for this.

Open the four affected deployment guides and locate the installation section containing mv ./meilisearch /usr/local/bin/; first compare the surrounding steps and existing note style. Add the SELinux note after that step in each guide, including the shown failure, affected distributions, restorecon, and ls -Z, then verify all four pages render.