Skip to content

feature: support selinux#4639

Open
ningmingxiao wants to merge 1 commit intocontainerd:mainfrom
ningmingxiao:selinux_support
Open

feature: support selinux#4639
ningmingxiao wants to merge 1 commit intocontainerd:mainfrom
ningmingxiao:selinux_support

Conversation

@ningmingxiao
Copy link
Copy Markdown
Contributor

@ningmingxiao ningmingxiao commented Dec 6, 2025 •
edited
Loading

@ningmingxiao ningmingxiao force-pushed the selinux_support branch 7 times, most recently from d69b7e0 to 2eaa687 Compare December 6, 2025 15:21
@ningmingxiao ningmingxiao changed the title feature:support selinux use --security-opt label=xxx feature:support selinux Dec 6, 2025
@ningmingxiao ningmingxiao changed the title feature:support selinux feature: support selinux Dec 6, 2025
This was referenced Dec 6, 2025
Open
Open
AkihiroSuda
AkihiroSuda reviewed Dec 8, 2025
View reviewed changes
Comment thread cmd/nerdctl/container/container_run_security_linux_test.go Outdated
AkihiroSuda
AkihiroSuda reviewed Dec 8, 2025
View reviewed changes
Comment thread cmd/nerdctl/container/container_run_security_linux_test.go Outdated
AkihiroSuda
AkihiroSuda reviewed Dec 8, 2025
View reviewed changes
Comment thread cmd/nerdctl/container/container_run_security_linux_test.go Outdated
AkihiroSuda
AkihiroSuda reviewed Dec 8, 2025
View reviewed changes
Comment thread pkg/config/config.go Outdated
AkihiroSuda
AkihiroSuda reviewed Dec 8, 2025
View reviewed changes
Comment thread cmd/nerdctl/container/container_run_security_linux_test.go Outdated
AkihiroSuda
AkihiroSuda reviewed Dec 8, 2025
View reviewed changes
Comment thread cmd/nerdctl/container/container_run_security_linux_test.go Outdated
AkihiroSuda
AkihiroSuda reviewed Dec 8, 2025
View reviewed changes
Comment thread cmd/nerdctl/container/container_run_security_linux_test.go
AkihiroSuda
AkihiroSuda reviewed Dec 8, 2025
View reviewed changes
Comment thread cmd/nerdctl/container/container_run_security_linux_test.go Outdated
if err != nil {
output := strings.TrimSpace(string(stdout))
if strings.Contains(output, "container_t") {
t.Fatal(fmt.Errorf("expect label container_t but get %s", output))
Copy link
Copy Markdown
Member

@AkihiroSuda AkihiroSuda Dec 8, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The uniqueness of the MCS categories have to be checked too?

Copy link
Copy Markdown
Contributor Author

@ningmingxiao ningmingxiao Dec 11, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

what do you think how to check? @AkihiroSuda

Copy link
Copy Markdown
Member

@AkihiroSuda AkihiroSuda Dec 22, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Just run multiple containers and check that the MCS categories are different

Copy link
Copy Markdown
Contributor Author

@ningmingxiao ningmingxiao Dec 22, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

because nerdctl doesn't save selinux label into db, nerdctl is a brief process， so may have chance to have same MCS categories . may be I should refer container id to keep special.

Copy link
Copy Markdown
Contributor Author

@ningmingxiao ningmingxiao Dec 22, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

what's the disadvantage if 2 containers have same MCS categories ?

Copy link
Copy Markdown
Contributor Author

@ningmingxiao ningmingxiao Dec 22, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

or we should let containerd call label.InitLabels(labelOpts) instead of let nerdctl create it @AkihiroSuda

AkihiroSuda
AkihiroSuda reviewed Dec 8, 2025
View reviewed changes
Comment thread docs/command-reference.md
@AkihiroSuda AkihiroSuda added this to the v2.3.0 milestone Dec 8, 2025
@ningmingxiao ningmingxiao marked this pull request as draft December 9, 2025 01:52
@ningmingxiao ningmingxiao force-pushed the selinux_support branch 5 times, most recently from ec3feb9 to 977dba6 Compare December 11, 2025 02:14
AkihiroSuda
AkihiroSuda reviewed Dec 11, 2025
View reviewed changes
Comment thread pkg/testutil/nerdtest/requirements.go Outdated
AkihiroSuda
AkihiroSuda reviewed Dec 11, 2025
View reviewed changes
Comment thread cmd/nerdctl/container/container_run_security_linux_test.go
AkihiroSuda
AkihiroSuda reviewed Dec 11, 2025
View reviewed changes
Comment thread cmd/nerdctl/container/container_run_security_linux_test.go
{
Description: "test run with selinux-enabled",
Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
return helpers.Command("--selinux-enabled", "run", "-d", "-v", fmt.Sprintf("/%s:/%s:Z", testContainer, testContainer), "--name", testContainer, "sleep", "infinity")
Copy link
Copy Markdown
Member

@AkihiroSuda AkihiroSuda Dec 11, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

lower z should be tested too
https://docs.docker.com/engine/storage/bind-mounts/#configure-the-selinux-label

The z option indicates that the bind mount content is shared among multiple containers.
The Z option indicates that the bind mount content is private and unshared.

This should be verified by launching multiple containers

AkihiroSuda
AkihiroSuda reviewed Dec 11, 2025
View reviewed changes
Comment thread pkg/mountutil/mountutil_linux.go Outdated
@AkihiroSuda
Copy link
Copy Markdown
Member

AkihiroSuda commented Dec 22, 2025

Needs rebase

@ningmingxiao ningmingxiao force-pushed the selinux_support branch 3 times, most recently from 565bbde to 59bc5ef Compare December 22, 2025 10:58
@ningmingxiao
Copy link
Copy Markdown
Contributor Author

ningmingxiao commented Dec 22, 2025

Needs rebase

done

@ningmingxiao
Copy link
Copy Markdown
Contributor Author

ningmingxiao commented Dec 25, 2025 •
edited
Loading

do we need add a new api in containerd to manage selinuxlabel ? because " label.InitLabels(labelOptions)" should run on server to keep unique @AkihiroSuda

ChengyuZhu6
ChengyuZhu6 reviewed Jan 21, 2026
View reviewed changes
Copy link
Copy Markdown
Member

@ChengyuZhu6 ChengyuZhu6 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@ningmingxiao I’ve left a few comments; please take a look.

Comment thread cmd/nerdctl/container/container_run_security_linux_test.go
Comment thread cmd/nerdctl/container/container_run_security_linux_test.go
},
}
}
func TestRunSelinux(t *testing.T) {
Copy link
Copy Markdown
Member

@ChengyuZhu6 ChengyuZhu6 Jan 21, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Same too.

Comment thread cmd/nerdctl/container/container_run_security_linux_test.go
Comment thread pkg/cmd/container/run_security_linux.go Outdated
Comment thread docs/config.md
Copy link
Copy Markdown
Member

@ChengyuZhu6 ChengyuZhu6 Jan 21, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

missing selinux_enabled from Properties table.

Comment thread cmd/nerdctl/container/container_run_security_linux_test.go
@ningmingxiao
Copy link
Copy Markdown
Contributor Author

ningmingxiao commented Jan 21, 2026

ok I will fix it later I'm fixing selinux name conflict. @ChengyuZhu6

@AkihiroSuda
Copy link
Copy Markdown
Member

AkihiroSuda commented Mar 5, 2026

What's the current status?

We will release v2.3 next month, and would like to include this PR if possible

@ningmingxiao
Copy link
Copy Markdown
Contributor Author

ningmingxiao commented Mar 12, 2026

I will try to fix it this week @AkihiroSuda

@AkihiroSuda
Copy link
Copy Markdown
Member

AkihiroSuda commented Apr 5, 2026

Needs rebase

@ningmingxiao ningmingxiao force-pushed the selinux_support branch 2 times, most recently from 9b44887 to 8bc2728 Compare April 7, 2026 11:36
@AkihiroSuda AkihiroSuda requested review from a team and ChengyuZhu6 April 7, 2026 12:39
ChengyuZhu6
ChengyuZhu6 reviewed Apr 10, 2026
View reviewed changes
Copy link
Copy Markdown
Member

@ChengyuZhu6 ChengyuZhu6 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@ningmingxiao Overall it looks good. Left some comments.

Comment thread pkg/cmd/container/run_security_linux.go Outdated
Comment thread docs/command-reference.md Outdated
sathiraumesh
sathiraumesh reviewed Apr 11, 2026
View reviewed changes
Comment thread cmd/nerdctl/container/container_run_security_linux_test.go
},
Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
return &test.Expected{
ExitCode: 0,
Copy link
Copy Markdown
Contributor

@sathiraumesh sathiraumesh Apr 11, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

can use expect.ExitCodeSuccess

Comment thread cmd/nerdctl/container/container_run_security_linux_test.go
Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
return &test.Expected{
ExitCode: 0,
Output: expect.All(
Copy link
Copy Markdown
Contributor

@sathiraumesh sathiraumesh Apr 11, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

same here can use expect.ExitCodeSuccess

Comment thread cmd/nerdctl/container/container_run_security_linux_test.go
@AkihiroSuda
Copy link
Copy Markdown
Member

AkihiroSuda commented Apr 20, 2026

ping @ningmingxiao

@ningmingxiao ningmingxiao force-pushed the selinux_support branch 2 times, most recently from 355a21f to a7e3245 Compare April 21, 2026 02:18
@ningmingxiao
feature: support selinux
4f55433 
Signed-off-by: ningmingxiao <ning.mingxiao@zte.com.cn>
@ningmingxiao
Copy link
Copy Markdown
Contributor Author

ningmingxiao commented Apr 21, 2026

done @AkihiroSuda

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@AkihiroSuda AkihiroSuda AkihiroSuda left review comments

@ChengyuZhu6 ChengyuZhu6 ChengyuZhu6 left review comments

+1 more reviewer

@sathiraumesh sathiraumesh sathiraumesh left review comments

Reviewers whose approvals may not affect merge requirements

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

impact/changelog

Projects

None yet

Milestone

v2.3.0

Development

Successfully merging this pull request may close these issues.

4 participants

@ningmingxiao @AkihiroSuda @sathiraumesh @ChengyuZhu6