Makefile: Mount . with --security-opt label=disable instead of using --privileged #15479
Conversation
dcermak
force-pushed
the
don-t-use-privileged-containers
branch
from
c285fcd to
00b58e4
Compare
|
NO, You should not use :Z to relabel the users homedirectory every time this is done. The better fix is to just disable SELinux during the running of the container. --security-opt label=disabled. |
dcermak
force-pushed
the
don-t-use-privileged-containers
branch
from
00b58e4 to
fbeb42b
Compare
Done, thanks for the suggestion! |
rhatdan
changed the title
|
LGTM |
$(CURDIR) is mounted in podman as is which causes issues on systems with SELinux as then the container cannot read or write anything inside /src/. This has been worked around with the --privileged flag, but that's a rather brutal solution. Adding :Z is also suboptimal, as that requires a full relabeling after every run. Instead, we disable security labeling via `--security-opt label=disable` for this development container allowing us to run `make vendor-in-container` unprivileged. Signed-off-by: Dan Čermák <[email protected]>
dcermak
force-pushed
the
don-t-use-privileged-containers
branch
from
fbeb42b to
dcb4d43
Compare
|
Daniel J Walsh ***@***.***> writes:
LGTM
But can you fix the commit message.
Yes, should be fixed now.
|
openshift-ci
bot
added
the
do-not-merge/hold
|
/approve |
openshift-ci
bot
removed
the
do-not-merge/hold
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: dcermak, rhatdan The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
openshift-ci
bot
added
the
approved
github-actions
bot
added
the
locked - please file new issue/PR
$(CURDIR)is mounted in podman without:Zwhich causes issues on systems with SELinux as then the container cannot read or write anything inside/src/. This has been worked around with the--privilegedflag, but that's a rather brutal solution. Instead, adding the proper SELinux sharing setting fixes the problem and allowsmake vendor-in-containerto run unprivileged.Does this PR introduce a user-facing change?