4

I ran through the fig python / django tutorial on Fedora 20 (docker 1.0.0) but it failed & tripped an AVC denial in SELinux when django-admin.py attempted to create the project files.

I reviewed the policy, i can see that setting the docker_var_lib_t context on my code dir would permit docker to write there (although i've just spied docker_share_t in the policy, that looks a better fit permissions wise - no chr / blk devices in that context).

Code directory locations are not predictable so setting a system wide policy (via semanage fcontext) doesn't seem the best way forward; i'd need to introduce some kind of convention.

Is there any way to automatically set this context on volumes mounted from a host?

CraigJPerry
  • 973
  • 1
  • 8
  • 16

1 Answers1

2

You can set the following context on the directory

chcon -Rt svirt_sandbox_file_t $HOME/code/export

then run your docker command as

docker run --rm -it -v $HOME/code/export:/exported:ro image /foo/bar

Prudhvi Krishna Surapaneni
  • 69
  • 1
  • 4