-
Notifications
You must be signed in to change notification settings - Fork 70
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
SELinux behaves completely differently when I podman run
vs. bootc switch
my container image
#439
Comments
This is the behavior when running as a container with
This is the behavior when running via
The following shows up in the journal as expected:
|
Yeah, it's because Now...yes. Arguably, we could change policy to e.g. make new unknown toplevels just be (But clearly it needs to be configurable in the container anyways) |
The behavior of SELinux seems completely different when I run my bootable container under
podman run
vs deploying it (for example viabootc switch
).I think that SELinux works differently for containers (which it treats as a single security context) than it does with hosts (very fine grained). This means many commands such as
WORKDIR
orRUN
in my Containerfile have unexpected results.The following Containerfile doesn't work (as an example):
With the following run.service file:
And the following run.sh file:
This works when running as an application container, but fails when running as a bootable container, due to completely different SELinux models.
The text was updated successfully, but these errors were encountered: