Switch to using opencontainers/selinux for selinux bindings#32687
Switch to using opencontainers/selinux for selinux bindings#32687vdemeester merged 1 commit intomoby:masterfrom
Conversation
|
Ping anyone, why aren't tests running for this PR? |
There was a problem hiding this comment.
Filecon to FileLabel in this comment.
There was a problem hiding this comment.
Nice catch, could you open a PR to fix this in opencontainers/selinux?
cpuguy83
left a comment
cpuguy83
left a comment
There was a problem hiding this comment.
I don't think we should make any changes until we have a strongly-typed object for handing off selinux context from the daemon.
For instance in swarm we use this:
moby/api/types/swarm/container.go
Line 25 in 091b5e6
There was a problem hiding this comment.
This change seems like it's going to break stuff.
Why the change?
Definitely breaking https://github.com/moby/moby/blob/master/daemon/cluster/executor/container/container.go#L624
There was a problem hiding this comment.
label should not be in any SELinux specific section. this should be in the label section but not in the selinux specific section.
I don't understand....this change is super-transparent and what you're saying can be postponed for sure, in the mean time we'll switch to OCI/selinux since there's no libcontainer/selinux anymore. If something happen to be incorrect we'll fix OCI/selinux directly that way... |
|
Ok I see you've got this label conversion happening in Docker now. That's fine. Will need to do some manual testing on this just to make sure we're not breaking anything (seems ok, but just want to be sure). |
Signed-off-by: Antonio Murdaca <[email protected]>
|
everything green 💚 |
Signed-off-by: Fabio Kung <[email protected]> (cherry picked from commit 9134e87) Signed-off-by: Kir Kolyshkin <[email protected]> Conflicts: - container/container.go: missing moby#33241, moby#32687 Signed-off-by: Kir Kolyshkin <[email protected]>
7 participants
Carry of #32011, hopefully tests are green here.
@cpuguy83 @thaJeztah @vdemeester @rhatdan PTAL
Signed-off-by: Antonio Murdaca [email protected]