Merge branch 'containers-unpriv-user' into custom-node

poupas · Sep 10, 2021 · e745b5f · e745b5f
2 parents 7944c9c + 8e54314
commit e745b5f
Show file tree

Hide file tree

Showing 4 changed files with 28 additions and 20 deletions.
diff --git a/amd64/rp-smartnode-install/network/mainnet/docker-compose.yml b/amd64/rp-smartnode-install/network/mainnet/docker-compose.yml
@@ -45,7 +45,7 @@ services:
     container_name: ${COMPOSE_PROJECT_NAME}_node
     restart: unless-stopped
     volumes:
-      - /var/run/docker.sock:/var/run/docker.sock:z
+      - /var/run/docker.sock:/var/run/docker.sock
       - .:/.rocketpool:z
     networks:
       - net
@@ -56,6 +56,8 @@ services:
       - dac_override
     security_opt:
       - no-new-privileges
+      # Required to access the Docker socket on SELinux enforcing environments
+      - label=disable
   watchtower:
     image: ${SMARTNODE_IMAGE}
     container_name: ${COMPOSE_PROJECT_NAME}_watchtower

diff --git a/amd64/rp-smartnode-install/network/prater/docker-compose.yml b/amd64/rp-smartnode-install/network/prater/docker-compose.yml
@@ -45,7 +45,7 @@ services:
     container_name: ${COMPOSE_PROJECT_NAME}_node
     restart: unless-stopped
     volumes:
-      - /var/run/docker.sock:/var/run/docker.sock:z
+      - /var/run/docker.sock:/var/run/docker.sock
       - .:/.rocketpool:z
     networks:
       - net
@@ -56,6 +56,8 @@ services:
       - dac_override
     security_opt:
       - no-new-privileges
+      # Required to access the Docker socket on SELinux enforcing environments
+      - label=disable
   watchtower:
     image: ${SMARTNODE_IMAGE}
     container_name: ${COMPOSE_PROJECT_NAME}_watchtower

diff --git a/arm64/rp-smartnode-install/network/mainnet/docker-compose.yml b/arm64/rp-smartnode-install/network/mainnet/docker-compose.yml
@@ -10,7 +10,7 @@ services:
       - "${ETH1_P2P_PORT:-30303}:${ETH1_P2P_PORT:-30303}/tcp"
     volumes:
       - eth1clientdata:/ethclient
-      - ./chains/eth1:/setup:ro,Z
+      - ./chains/eth1:/setup:ro,z
     networks:
       - net
     environment:
@@ -38,9 +38,9 @@ services:
       - "${ETH2_P2P_PORT:-9001}:${ETH2_P2P_PORT:-9001}/tcp"
       - "${ETH2_P2P_PORT:-9001}:${ETH2_P2P_PORT:-9001}/udp"
     volumes:
-      - ./data/validators:/validators:Z
+      - ./data/validators:/validators:z
       - eth2clientdata:/ethclient
-      - ./chains/eth2:/setup:ro,Z
+      - ./chains/eth2:/setup:ro,z
     networks:
       - net
     environment:
@@ -66,8 +66,8 @@ services:
     restart: unless-stopped
     stop_grace_period: 3m
     volumes:
-      - ./data/validators:/validators:Z
-      - ./chains/eth2:/setup:ro,Z
+      - ./data/validators:/validators:z
+      - ./chains/eth2:/setup:ro,z
     networks:
       - net
     environment:
@@ -90,7 +90,7 @@ services:
     stop_signal: SIGKILL
     stop_grace_period: 1s
     volumes:
-      - .:/.rocketpool:Z
+      - .:/.rocketpool:z
     networks:
       - net
     depends_on:
@@ -108,8 +108,8 @@ services:
     container_name: ${COMPOSE_PROJECT_NAME}_node
     restart: unless-stopped
     volumes:
-      - /var/run/docker.sock:/var/run/docker.sock:Z
-      - .:/.rocketpool:Z
+      - /var/run/docker.sock:/var/run/docker.sock
+      - .:/.rocketpool:z
     networks:
       - net
     command: "-m 0.0.0.0 -r ${NODE_METRICS_PORT:-9102} node"
@@ -122,12 +122,14 @@ services:
       - dac_override
     security_opt:
       - no-new-privileges
+      # Required to access the Docker socket on SELinux enforcing environments
+      - label=disable
   watchtower:
     image: ${SMARTNODE_IMAGE}
     container_name: ${COMPOSE_PROJECT_NAME}_watchtower
     restart: unless-stopped
     volumes:
-      - .:/.rocketpool:Z
+      - .:/.rocketpool:z
     networks:
       - net
     command: "watchtower"

diff --git a/arm64/rp-smartnode-install/network/prater/docker-compose.yml b/arm64/rp-smartnode-install/network/prater/docker-compose.yml
@@ -10,7 +10,7 @@ services:
       - "${ETH1_P2P_PORT:-30303}:${ETH1_P2P_PORT:-30303}/tcp"
     volumes:
       - eth1clientdata:/ethclient
-      - ./chains/eth1:/setup:ro,Z
+      - ./chains/eth1:/setup:ro,z
     networks:
       - net
     environment:
@@ -38,9 +38,9 @@ services:
       - "${ETH2_P2P_PORT:-9001}:${ETH2_P2P_PORT:-9001}/tcp"
       - "${ETH2_P2P_PORT:-9001}:${ETH2_P2P_PORT:-9001}/udp"
     volumes:
-      - ./data/validators:/validators:Z
+      - ./data/validators:/validators:z
       - eth2clientdata:/ethclient
-      - ./chains/eth2:/setup:ro,Z
+      - ./chains/eth2:/setup:ro,z
     networks:
       - net
     environment:
@@ -66,8 +66,8 @@ services:
     restart: unless-stopped
     stop_grace_period: 3m
     volumes:
-      - ./data/validators:/validators:Z
-      - ./chains/eth2:/setup:ro,Z
+      - ./data/validators:/validators:z
+      - ./chains/eth2:/setup:ro,z
     networks:
       - net
     environment:
@@ -90,7 +90,7 @@ services:
     stop_signal: SIGKILL
     stop_grace_period: 1s
     volumes:
-      - .:/.rocketpool:Z
+      - .:/.rocketpool:z
     networks:
       - net
     depends_on:
@@ -108,8 +108,8 @@ services:
     container_name: ${COMPOSE_PROJECT_NAME}_node
     restart: unless-stopped
     volumes:
-      - /var/run/docker.sock:/var/run/docker.sock:Z
-      - .:/.rocketpool:Z
+      - /var/run/docker.sock:/var/run/docker.sock
+      - .:/.rocketpool:z
     networks:
       - net
     command: "-m 0.0.0.0 -r ${NODE_METRICS_PORT:-9102} node"
@@ -122,12 +122,14 @@ services:
       - dac_override
     security_opt:
       - no-new-privileges
+      # Required to access the Docker socket on SELinux enforcing environments
+      - label=disable
   watchtower:
     image: ${SMARTNODE_IMAGE}
     container_name: ${COMPOSE_PROJECT_NAME}_watchtower
     restart: unless-stopped
     volumes:
-      - .:/.rocketpool:Z
+      - .:/.rocketpool:z
     networks:
       - net
     command: "watchtower"