In Fedora 25 I grabbed the new kernel with overlayfs support [1] and I configured docker to run with overlayfs by using DOCKER_STORAGE_OPTIONS="--storage-driver=overlay2" in /etc/sysconfig/docker-storage.
[1] https://kojipkgs.fedoraproject.org//packages/kernel/4.8.0/0.rc5.git4.1.fc25/x86_64/kernel-core-4.8.0-0.rc5.git4.1.fc25.x86_64.rpm Trying to start up some containers now and getting some errors: ``` [root@cloudhost ~]# docker run -it --rm centos:7 standard_init_linux.go:175: exec user process caused "permission denied" ``` The journal output shows me: ``` Sep 11 03:28:53 cloudhost.localdomain systemd[1]: Started docker container 384a8d8b06c8895583b477a15bcfbe5864cdfa96c2c0f75efb752bb1022b562b. Sep 11 03:28:53 cloudhost.localdomain kernel: SELinux: mount invalid. Same superblock, different security settings for (dev mqueue, type mqueue) Sep 11 03:28:53 cloudhost.localdomain kernel: eth0: renamed from veth42eaf25 Sep 11 03:28:53 cloudhost.localdomain kernel: IPv6: ADDRCONF(NETDEV_CHANGE): veth67c0994: link becomes ready Sep 11 03:28:53 cloudhost.localdomain kernel: docker0: port 1(veth67c0994) entered blocking state Sep 11 03:28:53 cloudhost.localdomain kernel: docker0: port 1(veth67c0994) entered forwarding state Sep 11 03:28:53 cloudhost.localdomain oci-register-machine[1353]: 2016/09/11 03:28:53 Register machine: prestart 384a8d8b06c8895583b477a15bcfbe5864cdfa96c2c0f75efb752bb1022b562b 1336 /var/lib/docker/overlay2/e282c2e4f395fc9146152525394f428a0e05d7bd23022411b9dec5372624ce8c/merged Sep 11 03:28:53 cloudhost.localdomain systemd-machined[1102]: New machine 384a8d8b06c8895583b477a15bcfbe58. Sep 11 03:28:53 cloudhost.localdomain oci-systemd-hook[1357]: systemdhook <debug>: Skipping as container command is /bin/bash, not init or systemd Sep 11 03:28:53 cloudhost.localdomain systemd[1]: libcontainer-1360-systemd-test-default-dependencies.scope: Scope has no PIDs. Refusing. Sep 11 03:28:53 cloudhost.localdomain systemd[1]: libcontainer-1360-systemd-test-default-dependencies.scope: Scope has no PIDs. Refusing. Sep 11 03:28:53 cloudhost.localdomain audit[1336]: AVC avc: denied { entrypoint } for pid=1336 comm="exe" path="/usr/bin/bash" dev="overlay" ino=19026 scontext=system_u:system_r:svirt_lxc_net_t:s0:c130,c692 tcontext=system_u:object_r:docker_var_lib_t:s0 tclass=file permissive=0 Sep 11 03:28:53 cloudhost.localdomain dockerd[875]: [73B blob data] Sep 11 03:28:53 cloudhost.localdomain systemd-machined[1102]: Machine 384a8d8b06c8895583b477a15bcfbe58 terminated. ``` some more information: ``` [root@cloudhost ~]# rpm -q kernel-core docker selinux-policy kernel-core-4.8.0-0.rc5.git4.1.fc25.x86_64 docker-1.12.1-10.git9a3752d.fc25.x86_64 selinux-policy-3.13.1-211.fc25.noarch [root@cloudhost ~]# docker info Containers: 0 Running: 0 Paused: 0 Stopped: 0 Images: 2 Server Version: 1.12.1 Storage Driver: overlay2 Backing Filesystem: extfs Logging Driver: journald Cgroup Driver: systemd Plugins: Volume: local Network: null host bridge overlay Swarm: inactive Runtimes: oci runc Default Runtime: oci Security Options: seccomp selinux Kernel Version: 4.8.0-0.rc5.git1.1.fc25.x86_64 Operating System: Fedora 25 (Cloud Edition) OSType: linux Architecture: x86_64 Number of Docker Hooks: 2 CPUs: 2 Total Memory: 3.859 GiB Name: cloudhost.localdomain ID: 4D6B:PZJU:4DF4:BUAW:3H3X:ILC3:MQ4V:2WWU:PWDQ:DMOA:TADT:EOKK Docker Root Dir: /var/lib/docker Debug Mode (client): false Debug Mode (server): false Registry: https://index.docker.io/v1/ Insecure Registries: 127.0.0.0/8 Registries: docker.io (secure) ``` If I setenforce 0, it works. Can someone else confirm the behavior? Should I open a bug? Dusty
