feature: support selinux by ningmingxiao · Pull Request #4639 · containerd/nerdctl

ningmingxiao · 2025-12-06T09:19:47Z

ping @AkihiroSuda

cmd/nerdctl/container/container_run_security_linux_test.go

pkg/config/config.go

cmd/nerdctl/container/container_run_security_linux_test.go

AkihiroSuda · 2025-12-08T03:58:35Z

cmd/nerdctl/container/container_run_security_linux_test.go

+	if err != nil {
+		output := strings.TrimSpace(string(stdout))
+		if strings.Contains(output, "container_t") {
+			t.Fatal(fmt.Errorf("expect label container_t but get %s", output))


The uniqueness of the MCS categories have to be checked too?

what do you think how to check? @AkihiroSuda

Just run multiple containers and check that the MCS categories are different

because nerdctl doesn't save selinux label into db, nerdctl is a brief process， so may have chance to have same MCS categories . may be I should refer container id to keep special.

what's the disadvantage if 2 containers have same MCS categories ?

or we should let containerd call label.InitLabels(labelOpts) instead of let nerdctl create it @AkihiroSuda

docs/command-reference.md

AkihiroSuda · 2025-12-11T06:10:48Z

docs/config.md

+selinux_enabled= true
 ```

 ## Properties


Needs to be updated

I don't understand what you meean ? about selinux_enabled= true @AkihiroSuda

pkg/testutil/nerdtest/requirements.go

cmd/nerdctl/container/container_run_security_linux_test.go

AkihiroSuda · 2025-12-11T06:14:35Z

cmd/nerdctl/container/container_run_security_linux_test.go

+		{
+			Description: "test run with selinux-enabled",
+			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
+				return helpers.Command("--selinux-enabled", "run", "-d", "-v", fmt.Sprintf("/%s:/%s:Z", testContainer, testContainer), "--name", testContainer, "sleep", "infinity")


lower z should be tested too
https://docs.docker.com/engine/storage/bind-mounts/#configure-the-selinux-label

The z option indicates that the bind mount content is shared among multiple containers.
The Z option indicates that the bind mount content is private and unshared.

This should be verified by launching multiple containers

pkg/mountutil/mountutil_linux.go

AkihiroSuda · 2025-12-22T09:50:59Z

Needs rebase

ningmingxiao · 2025-12-22T11:02:38Z

Needs rebase

done

Signed-off-by: ningmingxiao <ning.mingxiao@zte.com.cn>

ningmingxiao · 2025-12-25T02:07:41Z

do we need add a new api in containerd to manage selinuxlabel ? because " label.InitLabels(labelOptions)" should run on server to keep unique @AkihiroSuda

ChengyuZhu6

@ningmingxiao I’ve left a few comments; please take a look.

ChengyuZhu6 · 2026-01-21T02:44:47Z

cmd/nerdctl/container/container_run_security_linux_test.go

 	base.Cmd("run", "--rm", "--privileged", testutil.AlpineImage, "cat", attrCurrentPath).AssertOutContains("unconfined")
 }

+func TestRunSelinuxWithSecurityOpt(t *testing.T) {


missing testCase.Run(t), subtests will not actually run.

ChengyuZhu6 · 2026-01-21T02:45:06Z

cmd/nerdctl/container/container_run_security_linux_test.go

+		},
+	}
+}
+func TestRunSelinux(t *testing.T) {


ChengyuZhu6 · 2026-01-21T02:45:41Z

cmd/nerdctl/container/container_run_security_linux_test.go

+	}
+}
+
+func TestRunSelinuxWithVolumeLabel(t *testing.T) {


ChengyuZhu6 · 2026-01-21T02:51:49Z

pkg/cmd/container/run_security_linux.go

+		opts = append(opts, WithSelinuxLabel(processLabel, mountLabel))
+	}
+	// if selinux-enabled=true and security-opt selinux label is not set.
+	if selinuxEnabled && len(labelOpts) == 0 {


When running with --privileged, SELinux labels should be disabled. From Docker docs: https://docs.docker.com/reference/cli/docker/container/run/#privileged

ChengyuZhu6 · 2026-01-21T02:54:21Z

docs/config.md

missing selinux_enabled from Properties table.

ChengyuZhu6 · 2026-01-21T02:55:24Z

cmd/nerdctl/container/container_run_security_linux_test.go

+			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
+				return helpers.Command("--selinux-enabled", "run", "-d", "-v", fmt.Sprintf("/%s:/%s:Z", testContainer, testContainer), "--name", testContainer, "sleep", "infinity")
+			},
+			Cleanup: func(data test.Data, helpers test.Helpers) {
+				helpers.Anyhow("rm", "-f", testContainer)
+			},


The test creates a directory at /{testContainer} on the host via the -v flag with :Z option, but the Cleanup function only removes the container, not the directory.

ningmingxiao · 2026-01-21T08:33:38Z

ok I will fix it later I'm fixing selinux name conflict. @ChengyuZhu6

ningmingxiao force-pushed the selinux_support branch 7 times, most recently from d69b7e0 to 2eaa687 Compare December 6, 2025 15:21

ningmingxiao changed the title ~~feature:support selinux use --security-opt label=xxx~~ feature:support selinux Dec 6, 2025

ningmingxiao changed the title ~~feature:support selinux~~ feature: support selinux Dec 6, 2025

ningmingxiao force-pushed the selinux_support branch from 2eaa687 to 1e356d6 Compare December 6, 2025 15:29

This was referenced Dec 6, 2025

Support SELinux: --security-opt label #4608

Open

Support nerdctl run --security-opt=XXX #11

Open

ningmingxiao force-pushed the selinux_support branch from 1e356d6 to 56a8926 Compare December 7, 2025 02:15

AkihiroSuda reviewed Dec 8, 2025

View reviewed changes

cmd/nerdctl/container/container_run_security_linux_test.go Outdated Show resolved Hide resolved

AkihiroSuda reviewed Dec 8, 2025

View reviewed changes

cmd/nerdctl/container/container_run_security_linux_test.go Outdated Show resolved Hide resolved

AkihiroSuda reviewed Dec 8, 2025

View reviewed changes

cmd/nerdctl/container/container_run_security_linux_test.go Outdated Show resolved Hide resolved

AkihiroSuda reviewed Dec 8, 2025

View reviewed changes

pkg/config/config.go Outdated Show resolved Hide resolved

AkihiroSuda reviewed Dec 8, 2025

View reviewed changes

cmd/nerdctl/container/container_run_security_linux_test.go Outdated Show resolved Hide resolved

AkihiroSuda reviewed Dec 8, 2025

View reviewed changes

cmd/nerdctl/container/container_run_security_linux_test.go Outdated Show resolved Hide resolved

AkihiroSuda reviewed Dec 8, 2025

View reviewed changes

cmd/nerdctl/container/container_run_security_linux_test.go Show resolved Hide resolved

AkihiroSuda reviewed Dec 8, 2025

View reviewed changes

docs/command-reference.md Show resolved Hide resolved

AkihiroSuda added this to the v2.3.0 milestone Dec 8, 2025

ningmingxiao force-pushed the selinux_support branch from 56a8926 to a210aa3 Compare December 9, 2025 00:52

ningmingxiao marked this pull request as draft December 9, 2025 01:52

ningmingxiao force-pushed the selinux_support branch 5 times, most recently from ec3feb9 to 977dba6 Compare December 11, 2025 02:14

ningmingxiao marked this pull request as ready for review December 11, 2025 06:06

AkihiroSuda reviewed Dec 11, 2025

View reviewed changes

pkg/testutil/nerdtest/requirements.go Outdated Show resolved Hide resolved

AkihiroSuda reviewed Dec 11, 2025

View reviewed changes

cmd/nerdctl/container/container_run_security_linux_test.go Show resolved Hide resolved

AkihiroSuda reviewed Dec 11, 2025

View reviewed changes

pkg/mountutil/mountutil_linux.go Outdated Show resolved Hide resolved

ningmingxiao force-pushed the selinux_support branch 3 times, most recently from 565bbde to 59bc5ef Compare December 22, 2025 10:58

feature: support selinux

e32acb4

Signed-off-by: ningmingxiao <ning.mingxiao@zte.com.cn>

ningmingxiao force-pushed the selinux_support branch from 59bc5ef to e32acb4 Compare December 22, 2025 12:04

ChengyuZhu6 reviewed Jan 21, 2026

View reviewed changes

AkihiroSuda added the impact/major label Feb 10, 2026

Conversation

ningmingxiao commented Dec 6, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

ningmingxiao Dec 11, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

ningmingxiao Dec 22, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

AkihiroSuda commented Dec 22, 2025

Uh oh!

ningmingxiao commented Dec 22, 2025

Uh oh!

ningmingxiao commented Dec 25, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

ChengyuZhu6 left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

ningmingxiao commented Jan 21, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

ningmingxiao commented Dec 6, 2025 •

edited

Loading

ningmingxiao Dec 11, 2025 •

edited

Loading

ningmingxiao Dec 22, 2025 •

edited

Loading

ningmingxiao commented Dec 25, 2025 •

edited

Loading