Search code examples
fedoradockerselinux

`docker run ubuntu:14.04 /bin/echo` produces SELinux error on Fedora 20


I'm trying to get the very basic steps of the docker installation running and I encounter this problem on Fedora 20:

$ sudo docker run ubuntu:14.04 /bin/echo
/bin/echo: error while loading shared libraries: libc.so.6: cannot open shared object file: No such file or directory

At the same time the SELinux Alert Browser records two alerts:

  • SELinux is preventing /bin/echo from read access on the lnk_file . (Apparently the file name is "".)
  • SELinux is preventing /bin/echo from read access on the file . (Empty filename again.)

What am I doing wrong, or is this a bug?

$ sudo docker version
Client version: 1.0.0
Client API version: 1.12
Go version (client): go1.2.2
Git commit (client): 63fe64c/1.0.0
Server version: 1.0.0
Server API version: 1.12
Go version (server): go1.2.2
Git commit (server): 63fe64c/1.0.0

$ yum info docker-io
Name        : docker-io
Arch        : x86_64
Version     : 1.0.0
Release     : 6.fc20

$ yum info selinux-policy
Name        : selinux-policy
Arch        : noarch
Version     : 3.12.1
Release     : 177.fc20

Solution

  • If you are using btrfs as your filesystem you can't use --selinux-enabled docker (--selinux-enabled is on by default from the docker-io f20 package)

    From RHEL7 docs 5.2. Secure Containers with SELinux (note at the bottom) "Note that currently it is not possible to run containers with SELinux enabled on the B-tree file system (Btrfs)"

    Is also mentioned in Docker and SELinux by Daniel Walsh from Red Hat at about 35min mark

    A few tests of my own confirm this as well. Fails on btrfs but mounting a ext4 filesystem at /var/lib/docker, restarting docker and running

    docker run ubuntu:14.04 /bin/echo foo
    

    works without error.