More open but not privileged domain?

[containers]

More open but not privileged domain?

[rhatdan]

security-opt label:disable does not disable SELinux, it just disables SELinux separation for the container running, the container as spc_t, which is pretty much the same as unconfined_t.

You could also attempt to run --security-opt label=type:unconfined_t which should get close to what you want if it works.

[cgwalters]

Yeah, but spc_t is very privileged right?

$ sudo docker run --security-opt seccomp:unconfined --security-opt label:type:unconfined_t --rm -ti --entrypoint bash  cgwalters/fdev
standard_init_linux.go:178: exec user process caused "permission denied"

type=AVC msg=audit(1510848928.752:945): avc:  denied  { transition } for  pid=18742 comm="runc:[2:INIT]" path="/usr/bin/bash" dev="dm-1" ino=549992339 scontext=system_u:system_r:container_runtime_t:s0 tcontext=system_u:system_r:unconfined_t:s0:c271,c960 tclass=process permissive=0

[cgwalters]

There's a whole other topic here in that I am increasingly feeling Docker isn't the right solution for "user pet containers" as I really want the container to be a child process of my login session for example. But...that's a whole other thing.

[rhatdan]

cgwalters, kpod might give you something closer.

[rhatdan]

We now have container_userns_t domain whose goal is to satisfy these needs.

[rhatdan]

@cgwalters https://github.com/containers/udica is an effort to facilitate this.