Docker with selinux enabled – relabeling content in /usr is not allowed – CentOS

I recently had a similar (albeit different issue), I found Juan’s SELinux and docker notes helpful.

I’m having troubles finding the documentation that highlighted the following point, but I recall seeing it and was able to get around my issues by accepting it as truth. I will update it if/when I stumble across it again; Not everything within /usr or /etc will grant you write access in SELinux. At least not in the context of Docker.

You can access the /etc and /usr directories within SELinux context, but you cannot obtain write everywhere, so z and Z will occasionally give you unable to label issues when spinning up docker containers with volume mounts from those locations. However, if you have SELinux protected files elsewhere, e.g. in a users home directory, you’d be able to have Docker relabel those files appropriately — that is you’d be able to write to those SELinux protected files/directories with the z or Z flags.

If you need to write within the /usr or /etc directories and obtaining the unable to relabel alert, the --privileged flag or --security-opt label:disable flag should be instead of the z syntax. This would allow you to have write access, but you’d need to remove the z from your volume mount as Docker would still give you the unable to relabel statement.

note, you can also invoke privileged in the docker-compose.yml via privileged: true for a given service