Skip to content

build: Fix docker run when selinux is enabled #21017

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Jul 8, 2025

Conversation

nirs
Copy link
Contributor

@nirs nirs commented Jul 2, 2025

When mouting volumes we need to use :Z suffix to allow access to the mounted directory. This fixes docker run when running on Fedora an other distros using selinux by default.

NOTE: This change was committed as part of #20746, but it was reverted by mistake by ##20852.

@k8s-ci-robot k8s-ci-robot added the cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. label Jul 2, 2025
@k8s-ci-robot k8s-ci-robot requested review from medyagh and prezha July 2, 2025 18:34
@k8s-ci-robot k8s-ci-robot added the needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. label Jul 2, 2025
@k8s-ci-robot
Copy link
Contributor

Hi @nirs. Thanks for your PR.

I'm waiting for a kubernetes member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

@k8s-ci-robot k8s-ci-robot added the size/S Denotes a PR that changes 10-29 lines, ignoring generated files. label Jul 2, 2025
@nirs
Copy link
Contributor Author

nirs commented Jul 2, 2025

@prezha can you confirm that this was reverted by mistake?

@medyagh
Copy link
Member

medyagh commented Jul 2, 2025

thats interesting...that was merged last month but the xcgo error happend today...I wonder why...

When mouting volumes we need to use :Z suffix to allow access to the
mounted directory. This fixes docker run when running on Fedora an other
distros using selinux by default.
@nirs nirs force-pushed the docker-selinux branch from fdc5ef8 to 52c086e Compare July 5, 2025 17:53
@nirs
Copy link
Contributor Author

nirs commented Jul 5, 2025

@medyagh @ComradeProgrammer can you add /ok-to-test? build should pass now after #21027 was merged.

@medyagh
Copy link
Member

medyagh commented Jul 8, 2025

/ok-to-test

@k8s-ci-robot k8s-ci-robot added ok-to-test Indicates a non-member PR verified by an org member that is safe to test. and removed needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. labels Jul 8, 2025
@minikube-pr-bot
Copy link

kvm2 driver with docker runtime

+----------------+----------+---------------------+
|    COMMAND     | MINIKUBE | MINIKUBE (PR 21017) |
+----------------+----------+---------------------+
| minikube start | 49.9s    | 51.8s               |
| enable ingress | 15.4s    | 15.1s               |
+----------------+----------+---------------------+

Times for minikube start: 49.3s 50.1s 47.7s 50.1s 52.3s
Times for minikube (PR 21017) start: 52.3s 52.4s 51.3s 51.8s 51.2s

Times for minikube ingress: 14.5s 16.0s 15.5s 16.0s 15.0s
Times for minikube (PR 21017) ingress: 15.5s 15.0s 15.0s 15.6s 14.5s

docker driver with docker runtime

+----------------+----------+---------------------+
|    COMMAND     | MINIKUBE | MINIKUBE (PR 21017) |
+----------------+----------+---------------------+
| minikube start | 24.6s    | 24.0s               |
| enable ingress | 13.2s    | 13.1s               |
+----------------+----------+---------------------+

Times for minikube (PR 21017) ingress: 13.3s 13.3s 13.3s 13.3s 12.3s
Times for minikube ingress: 12.8s 13.8s 12.3s 13.8s 13.3s

Times for minikube start: 25.3s 25.0s 23.5s 21.7s 27.6s
Times for minikube (PR 21017) start: 22.8s 22.6s 26.5s 24.0s 24.1s

docker driver with containerd runtime

+----------------+----------+---------------------+
|    COMMAND     | MINIKUBE | MINIKUBE (PR 21017) |
+----------------+----------+---------------------+
| minikube start | 23.5s    | 23.2s               |
| enable ingress | 23.6s    | 23.4s               |
+----------------+----------+---------------------+

Times for minikube start: 26.0s 21.9s 22.9s 23.0s 23.5s
Times for minikube (PR 21017) start: 24.8s 25.5s 22.5s 22.0s 21.2s

Times for minikube ingress: 22.8s 22.8s 22.8s 22.8s 26.8s
Times for minikube (PR 21017) ingress: 22.8s 23.3s 23.3s 23.8s 23.8s

@medyagh
Copy link
Member

medyagh commented Jul 8, 2025

/lgtm

@medyagh medyagh merged commit 11bf65d into kubernetes:master Jul 8, 2025
27 of 37 checks passed
@k8s-ci-robot k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Jul 8, 2025
@k8s-ci-robot
Copy link
Contributor

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: medyagh, nirs

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@k8s-ci-robot k8s-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Jul 8, 2025
@nirs nirs deleted the docker-selinux branch July 8, 2025 21:47
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
approved Indicates a PR has been approved by an approver from all required OWNERS files. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. lgtm "Looks good to me", indicates that a PR is ready to be merged. ok-to-test Indicates a non-member PR verified by an org member that is safe to test. size/S Denotes a PR that changes 10-29 lines, ignoring generated files.
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants