Skip to content

Conversation

boxerab
Copy link
Contributor

@boxerab boxerab commented Sep 16, 2025

Hello!
This commit simplifies the handling of SELinux. Instead of a shell script, I have just modified
the docker compose template to add :z notation to volumes that need to be sandboxed for SELinux.
I have tested this on my Fedora system with a fresh clone and it all works - no extra script needed.

Cheers,
Aaron

@manisandro
Copy link
Member

Judging by the comment here [1]

Use extreme caution with these options. Bind-mounting a system directory such as /home or /usr with the Z option renders your host machine inoperable and you may need to relabel the host machine files by hand.

I don't think it is a good idea to add this to the default docker-compose template. Rather, I'd just add a note in the README, pointing out also the risks.

[1] https://docs.docker.com/engine/storage/bind-mounts/#configure-the-selinux-label

@boxerab
Copy link
Contributor Author

boxerab commented Sep 16, 2025

Judging by the comment here [1]

Use extreme caution with these options. Bind-mounting a system directory such as /home or /usr with the Z option renders your host machine inoperable and you may need to relabel the host machine files by hand.

I don't think it is a good idea to add this to the default docker-compose template. Rather, I'd just add a note in the README, pointing out also the risks.

[1] https://docs.docker.com/engine/storage/bind-mounts/#configure-the-selinux-label

Thanks, I wasn't aware of these warnings. However, I am using the lower case :z option in the PR, so there should not be any issues with the host machine. How would you feel about my creating a second docker-compose template for SELinux, and I can add a note in the README ? The only issue is that two templates must be maintained.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants