beenull/moby
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

rootless: disable overlay2 if running with SELinux

Browse source 
Kernel 5.11 introduced support for rootless overlayfs, but incompatible with SELinux.

On the other hand, fuse-overlayfs is compatible.

Close issue 42333

Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
This commit is contained in:
Akihiro Suda 2021-04-28 15:37:36 +09:00
parent cdaf82ba3f
commit 4300a52606
No known key found for this signature in database
GPG key ID: 49524C6F9F638F1A
1 changed files with 10 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

10
daemon/graphdriver/overlayutils/overlayutils.go
View file

@ -37,6 +37,16 @@ func ErrDTypeNotSupported(driver, backingFs string) error {
// checkMultipleLowers parameter enables check for multiple lowerdirs,
// which is required for the overlay2 driver.
func SupportsOverlay(d string, checkMultipleLowers bool) error {
// We can't rely on go-selinux.GetEnabled() to detect whether SELinux is enabled,
// because RootlessKit doesn't mount /sys/fs/selinux in the child: https://github.com/rootless-containers/rootlesskit/issues/94
// So we check $_DOCKERD_ROOTLESS_SELINUX, which is set by dockerd-rootless.sh .
if os.Getenv("_DOCKERD_ROOTLESS_SELINUX") == "1" {
// Kernel 5.11 introduced support for rootless overlayfs, but incompatible with SELinux,
// so fallback to fuse-overlayfs.
// https://github.com/moby/moby/issues/42333
return errors.New("overlay is not supported for Rootless with SELinux")
}
td, err := ioutil.TempDir(d, "check-overlayfs-support")
if err != nil {
return err