How to use RUN --mount=type=bind with SELinux in a way that works with buildah and docker?

[wshanks]

I have a Dockerfile in a git repository with a line like this:

RUN --mount=type=bind,source=.,target=/tmp/source git clone --single-branch file:///tmp/source code_repo

I tried to use podman build on this Dockerfile and found that I needed to add ,Z onto the end of the mount options to avoid an SELinux permission error (I was testing in Fedora). With that change, the image can be built. However, docker build does not work with the ,Z option. Is there any subtle change that could let this step work with both podman and docker?

This step is just getting the code into the image. It could be replaced with a COPY but the current syntax is a little nicer for development because it avoids copying in any temporary files in the repo. A separate script could create a git bundle and copy that in but it is nice that the current Dockerfile does not require set up steps before building.

By the way, I had to make two other small changes to switch from docker to podman. I don't know if they are worth capturing anywhere else but I will mention them here:

1. I had been using docker build --secret=id=secret.txt which apparently is equivalent to docker build --secret=id=secret.txt,src=secret.txt but podman only supports the latter syntax.
2. My file originally had RUN --mount=source=.,target=/tmp/source,type=bind which worked fine with docker, but podman/buildah requires that type=bind be the first --mount option.

These were easy to address but are little papercuts for switching from docker to podman/buildah.

[tenturestept]

You can disable SELinux labeling entirely by putting

[containers]
label = false

in ~/.config/containers/containers.conf. I think even with this step it will be more secure than rootful Docker. Or for just one command, you can use --security-opt label=disable.

[rhatdan]

If you enable Docker with --selinux-enabled it will also work. Sadly Docker by default does not enable SELinux separation even on SELinux host platforms, providing very limited security. Someone should fix Docker to not throw an error, perhaps warning, when user specifies Z or z on Docker when the daemon is launched with --selinux-enabled=FALSE.