close
Skip to content

Rely on container-selinux for centos/fedora25/rhel#32437

Merged
cpuguy83 merged 1 commit into
moby:masterfrom
cpuguy83:container_selinux
May 12, 2017
Merged

Rely on container-selinux for centos/fedora25/rhel#32437
cpuguy83 merged 1 commit into
moby:masterfrom
cpuguy83:container_selinux

Conversation

@cpuguy83

@cpuguy83 cpuguy83 commented Apr 7, 2017

Copy link
Copy Markdown
Member

RH now provides container-selinux which provides everything we need
for docker's selinux policy. Rely on container-selinux where
available, and docker-engine-selinux when not.

This still builds the docker-engine-selinux package and presumably
makes it available, but is no longer a requirement in the
docker-engine package preferring container-selinux instead.

container-selinux is available on fedora24, however the version that
is available does not set the correct types on the dockerd binary. We
can use container-selinux and just supplement that with some of our
own policy, but for now just keep using docker-engine-selinux as is.

ping @andrewhsu @rhatdan

@cpuguy83 cpuguy83 mentioned this pull request Apr 7, 2017
Closed
@thaJeztah thaJeztah requested a review from runcom April 10, 2017 12:15
@thaJeztah

thaJeztah commented Apr 10, 2017

Copy link
Copy Markdown
Member

ping @runcom as well 👍

@runcom

runcom commented Apr 10, 2017

Copy link
Copy Markdown
Member

seems fine to me, I'll spin up a F25/F26 vm and test this out.

@rhatdan

rhatdan commented Apr 10, 2017

Copy link
Copy Markdown
Contributor

👍

@cpuguy83

cpuguy83 commented Apr 26, 2017

Copy link
Copy Markdown
Member Author

Ping

@cpuguy83
Rely on container-selinux for centos/fedora25/rhel
adb2ddf 
RH now provides `container-selinux` which provides everything we need
for docker's selinux policy. Rely on `container-selinux` where
available, and `docker-engine-selinux` when not.

This still builds the `docker-engine-selinux` package and presumably
makes it available, but is no longer a requirement in the
`docker-engine` package preferring `container-selinux` instead.

`container-selinux` is available on fedora24, however the version that
is available does not set the correct types on the `dockerd` binary. We
can use `container-selinux` and just supplement that with some of our
own policy, but for now just keep using `docker-engine-selinux` as is.

Signed-off-by: Brian Goff <cpuguy83@gmail.com>
@cpuguy83 cpuguy83 force-pushed the container_selinux branch from 63d1077 to adb2ddf Compare May 1, 2017 15:23
vdemeester
vdemeester approved these changes May 2, 2017
View reviewed changes

@vdemeester vdemeester left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM 🐢
/cc @runcom

@thaJeztah thaJeztah added this to the 17.06.0 milestone May 5, 2017
@andrewhsu

andrewhsu commented May 10, 2017

Copy link
Copy Markdown
Contributor

LGTM

stuff works:

$ make KEEP_BUNDLE=1 DOCKER_BUILD_PKGS='centos-7' rpm
$ docker run --rm -it -v `pwd`:/v -w /v centos:7 yum -y install bundles/latest/build-rpm/centos-7/RPMS/x86_64/docker-engine-17.06.0-*.rpm
...
Complete!

@thaJeztah

thaJeztah commented May 11, 2017

Copy link
Copy Markdown
Member

Just chatted with @runcom and he may have some time tomorrow to give it a spin, so I suggest to wait until tomorrow (thanks Antonio!)

@runcom

runcom commented May 12, 2017

Copy link
Copy Markdown
Member

LGTM!

@thaJeztah

thaJeztah commented May 12, 2017

Copy link
Copy Markdown
Member

Thank you @runcom 👍

@cpuguy83

cpuguy83 commented May 12, 2017

Copy link
Copy Markdown
Member Author

All green.

@cpuguy83 cpuguy83 merged commit c307f45 into moby:master May 12, 2017
@cpuguy83 cpuguy83 deleted the container_selinux branch May 17, 2017 17:46
@cognitiaclaeves

cognitiaclaeves commented Jun 15, 2017

Copy link
Copy Markdown

This looks like this has been built. Is the package released yet? I just hit this issue today, in Azure, with docker-ce-17.03.1.ce-1.el7.centos.x86_64.

@cpuguy83

cpuguy83 commented Jun 15, 2017

Copy link
Copy Markdown
Member Author

@cognitiaclaeves It'll be in the 17.06.

@cognitiaclaeves

cognitiaclaeves commented Jun 15, 2017

Copy link
Copy Markdown

I see it now. Is there a work around until then?

@rhatdan

rhatdan commented Jun 15, 2017

Copy link
Copy Markdown
Contributor

Container-selinux is continuously released. The latest package is in fedora-updates.

@cpuguy83

cpuguy83 commented Jun 16, 2017

Copy link
Copy Markdown
Member Author

@cognitiaclaeves Hit what issue, exactly?

@ericsysmin

ericsysmin commented Jul 5, 2017

Copy link
Copy Markdown

Please be aware this affects https://docs.docker.com/engine/installation/linux/docker-ce/centos/ where "Uninstall old version" causes previous up-to-date installations to be uninstalled due to changed dependency.

@thaJeztah thaJeztah mentioned this pull request Oct 2, 2017
Closed
@euank euank mentioned this pull request Nov 7, 2017
Closed
@thaJeztah thaJeztah mentioned this pull request Dec 27, 2017
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

2 more reviewers

@vdemeester vdemeester vdemeester approved these changes

@runcom runcom runcom approved these changes

Reviewers whose approvals may not affect merge requirements

Assignees

@tiborvass tiborvass

Labels

impact/changelog status/4-merge

Projects

None yet

Milestone

17.06.0

Development

Successfully merging this pull request may close these issues.

10 participants

@cpuguy83 @thaJeztah @runcom @rhatdan @andrewhsu @cognitiaclaeves @ericsysmin @vdemeester @tiborvass @GordonTheTurtle