How do you add zZ flags to docker volumes for SELinux?

[TheBritz]

I have a use case to be able to deploy docker containers via Terraform on a host with SELinux enabled. We are currently experiencing permissions issues related to this and have identified the zZ flags as a possible solution but it is not clear how these flags can be incorporated through the Terraform docker provider.

cli example (note :Z suffix on volume definition):

docker run -d -v /haproxy:/haproxy:Z --restart unless-stopped

For reference:
https://docs.docker.com/storage/bind-mounts/#configure-the-selinux-label
https://prefetch.net/blog/2017/09/30/using-docker-volumes-on-selinux-enabled-servers/

[mavogel]

Hi @TheBritz did you try it with the permissions property? -> see here

[adileo]

I faced the same issue with a host path shared across multiple containers, there is no way at the moment to specify the "z" flag

With a small change and by adding a parameter it should be feasible to fix it:

terraform-provider-docker/internal/provider/resource_docker_container_structures.go

Line 229 in 54685a5

retHostConfigBinds = append(retHostConfigBinds, volumeName+":"+containerPath+":"+readWrite)