SELinux is unmanageable; just turn it off if it gets in your way

Re:SELinux is unmanageable; just turn it off if it gets in y... by johannes1234321 on Wednesday April 27, 2022 @04:15AM (#31177572)

Mounting the docker socket into a container works.

If it's advisable is another question, as that gives full control over all other containers (and likely more)

[ Parent | on HN ]

Re:SELinux is unmanageable; just turn it off if it gets in y... by staticassertion on Wednesday April 27, 2022 @09:03AM (#31179332)

Mounting the docker socket makes it trivial to escape to the host since you can just launch a privileged container or mount arbitrary files. Plus the daemon generally runs as root.

At that point you may want to just run it on the host, but basically you'd better trust whatever it is.

[ Parent | on HN ]