Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
962: Fix SELinux labels to allow shared use. r=Emilgardis a=Alexhuszagh Ensure that the volumes are not mounted as private, unshared volumes since we might mount with the host filesystem. This also fixes permissions issues with reading data from a mounted volume using a rootless container engine. Fixes a bug introduced in #251. Closes #961. This is because the `Z` SELinux label assumes the data is not shared between containers and not being used by the host, as documented below: > If you use selinux you can add the z or Z options to modify the selinux label of the host file or directory being mounted into the container. This affects the file or directory on the host machine itself and can have consequences outside of the scope of Docker. > > - The z option indicates that the bind mount content is shared among multiple containers. > - The Z option indicates that the bind mount content is private and unshared. > > Use extreme caution with these options. Bind-mounting a system directory such as /home or /usr with the Z option renders your host machine inoperable and you may need to relabel the host machine files by hand. Prior to this, we used the `Z` label, when we should have been using the `z` label. Co-authored-by: Alex Huszagh <ahuszagh@gmail.com>
- Loading branch information