Limitations: add selinux support limitation

[grahamwhaley]

We do not currently support enablement of selinux in the
dockerd config. Document that.

Fixes: #252

Signed-off-by: Graham Whaley [email protected]

[nitkon]

LGTM

[jodh-intel]

I appreciate you're documenting the docker server side, but is this all essentially the same as the following?:

• https://github.com/kata-containers/documentation/blob/master/Limitations.md#docker---security-opt-option-partially-supported

That section doesn't spell it all out (as we don't want to have to enumerate all the security types which may change), but we don't support --security-opt label:$selinux_context.

[grahamwhaley]

Ah, so that is the link to how/where it gets passed into the runtime @jodh-intel - how about I add a ref in my new section over to that --security-opt one?

[ghost]

The ref section idea sounds good to me.

[jodh-intel]

@grahamwhaley - yep, that plan sounds good to me.

[amshinde]

@grahamwhaley k8s also has selinux labels: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#assign-selinux-labels-to-a-container
We should mention that as well for completeness.

[grahamwhaley]

OK, I've added a link to the other section to ref the non-working security option, and also a link out to the k8s selinux label page. @jodh-intel @amshinde ptal.

[jodh-intel]

lgtm

[amshinde]

lgtm

[grahamwhaley]

afaik, this is done. In theory, needs one more ack from @kata-containers/documentation , but, it seems pullapprove may not have registered @jodh-intel ack. I'm OK with somebody pushing this through if they want.

[GabyCT]

lgtm