Docker + SELinux

Posted by onodai.

Oracle Linux 7.7にDocker公式リポジトリからDockerを入れたら素直に動いてくれなかった 

[root@instance-20200211-1157 audit]# docker run hello-world
docker: Error response from daemon: OCI runtime create failed: container_linux.go:346: starting container process caused "process_linux.go:449: container init caused \"write /proc/self/attr/keycreate: permission denied\"": unknown.      
ERRO[0000] error waiting for container: context canceled

SELinuxを無効にしたら動いてくれたのでそれでよしとしてもよかったのだが、Oracle Cloud上で動いているサーバなのでSELinuxは有効の状態にしておきたかった
いろいろ調べてみると、どうやらDockerをインストールするときにcontainer-selinuxというパッケージが一緒にインストールされていてそいつがSELinuxのポリシーらしく、Docker側でSELinuxを扱えるようにしてあげる必要があるらしい
SELinuxを扱えるようにするには、dockerdにオプションで--selinux-enabledを渡すか、/etc/docker/daemon.jsonに"selinux-enabled": trueを追記してあげるとよいようだ
Docker - How to set SELinux file contexts when using a custom Docker data root

今回は/etc/docker/daemon.jsonに記述する方法を選択した
わたしの環境ではそのようなファイルは無かったので新規に作成した 

[root@instance-20200211-1157 audit]# cat <<EOF > /etc/docker/daemon.json
> {
>     "selinux-enabled": true
> }
> EOF
[root@instance-20200211-1157 audit]# cat /etc/docker/daemon.json
{
    "selinux-enabled": true
}
[root@instance-20200211-1157 audit]# systemctl restart docker
[root@instance-20200211-1157 audit]# systemctl status docker
● docker.service - Docker Application Container Engine
   Loaded: loaded (/usr/lib/systemd/system/docker.service; disabled; vendor preset: disabled)
   Active: active (running) since Tue 2020-02-11 05:07:38 GMT; 4s ago
     Docs: https://docs.docker.com
 Main PID: 4319 (dockerd)
    Tasks: 15
   Memory: 45.5M
   CGroup: /system.slice/docker.service
           mq4319 /usr/bin/dockerd -H fd:// --containerd=/run/containerd/containerd.sock
Feb 11 05:07:37 instance-20200211-1157 dockerd[4319]: time="2020-02-11T05:07:37.711492733Z" level=info msg="ClientConn switching balancer to \"pick_first\"" module=grpc
Feb 11 05:07:37 instance-20200211-1157 dockerd[4319]: time="2020-02-11T05:07:37.716772790Z" level=info msg="[graphdriver] using prior storage driver: overlay2"
Feb 11 05:07:37 instance-20200211-1157 dockerd[4319]: time="2020-02-11T05:07:37.933570815Z" level=info msg="Loading containers: start."
Feb 11 05:07:38 instance-20200211-1157 dockerd[4319]: time="2020-02-11T05:07:38.575306876Z" level=info msg="Default bridge (docker0) is assigned with an IP address 172.17.0.0/16. Daemon option --bip can be used to set ...rred IP address"
Feb 11 05:07:38 instance-20200211-1157 dockerd[4319]: time="2020-02-11T05:07:38.838090475Z" level=info msg="Loading containers: done."
Feb 11 05:07:38 instance-20200211-1157 dockerd[4319]: time="2020-02-11T05:07:38.864868880Z" level=warning msg="Not using native diff for overlay2, this may cause degraded performance for building images: kernel has CON...-driver=overlay2
Feb 11 05:07:38 instance-20200211-1157 dockerd[4319]: time="2020-02-11T05:07:38.865648858Z" level=info msg="Docker daemon" commit=633a0ea graphdriver(s)=overlay2 version=19.03.5
Feb 11 05:07:38 instance-20200211-1157 dockerd[4319]: time="2020-02-11T05:07:38.866054081Z" level=info msg="Daemon has completed initialization"
Feb 11 05:07:38 instance-20200211-1157 dockerd[4319]: time="2020-02-11T05:07:38.898716380Z" level=info msg="API listen on /var/run/docker.sock"
Feb 11 05:07:38 instance-20200211-1157 systemd[1]: Started Docker Application Container Engine.
Hint: Some lines were ellipsized, use -l to show in full.
[root@instance-20200211-1157 audit]# getenforce
Enforcing
[root@instance-20200211-1157 audit]# ps -axZ | grep docker
system_u:system_r:container_runtime_t:s0 4319 ? Ssl   0:00 /usr/bin/dockerd -H fd:// --containerd=/run/containerd/containerd.sock
unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 4459 pts/1 S+   0:00 grep --color=auto docker
[root@instance-20200211-1157 audit]# docker run hello-world

Hello from Docker!
This message shows that your installation appears to be working correctly.

To generate this message, Docker took the following steps:
 1. The Docker client contacted the Docker daemon.
 2. The Docker daemon pulled the "hello-world" image from the Docker Hub.
    (amd64)
 3. The Docker daemon created a new container from that image which runs the
    executable that produces the output you are currently reading.
 4. The Docker daemon streamed that output to the Docker client, which sent it
    to your terminal.

To try something more ambitious, you can run an Ubuntu container with:
 $ docker run -it ubuntu bash

Share images, automate workflows, and more with a free Docker ID:
 https://hub.docker.com/

For more examples and ideas, visit:
 https://docs.docker.com/get-started/
comments powered by Disqus