docker-compose on Fedora CoreOS: SELinux policy

[Sc0ttmeup]

Did you have any issues / solutions to running docker-compose with SELinux on Fedora CoreOS?

One container has been throwing a few avc: denied issues. It's possible to get around it by adding the line privileged: true to a compose.yaml .

I'd prefer to update the SELinux policy but I'm not sure how to go about it on Fedora CoreOS.

[major]

Are you mounting filesystem storage inside the container or are you using docker/podman volumes? That's been the source of most of my SELinux issues. You may need a :z or :Z on the end of your volumes string if so.

Can you share some of the errors?

[Sc0ttmeup]

I'm running a modified version of this docker compose file https://github.com/qdm12/gluetun?tab=readme-ov-file#setup

bind mount was originally set as:

    volumes:
      - /var/docker/gluetun:/gluetun

This did throw a SELinux error until the :z was added.

I think the next issue might be related to a tun adapter.

Logs are below. The first line can be resolved with the addition of :z to the bind mount.

Mar 04 05:37:03 CoreOS audit[578608]: AVC avc:  denied  { write } for  pid=578608 comm="gluetun-entrypo" name="gluetun" dev="sda4" ino=8389218 scontext=system_u:system_r:container_t:s0:c289,c378 tcontext=system_u:object_r:var_t:s0 tclass=dir permissive=0
Mar 04 06:57:30 CoreOS audit[596441]: AVC avc:  denied  { module_request } for  pid=596441 comm="ip6tables-nft" kmod="nfnetlink-subsys-10" scontext=system_u:system_r:container_t:s0:c283,c659 tcontext=system_u:system_r:kernel_t:s0 tclass=system permissive=0
Mar 04 06:57:32 CoreOS audit[596387]: AVC avc:  denied  { module_request } for  pid=596387 comm="gluetun-entrypo" kmod="char-major-10-200" scontext=system_u:system_r:container_t:s0:c283,c659 tcontext=system_u:system_r:kernel_t:s0 tclass=system permissive=0

[major]

This post here might help, but I have not verified this myself. https://stackoverflow.com/a/57166364