Bug 1369239

Summary: [extras-rhel-7.2.7] overlay2: Docker fails to run container with overlay2 graph driver configured
Product: Red Hat Enterprise Linux 7 Reporter: Vivek Goyal <vgoyal>
Component: docker-latestAssignee: Daniel Walsh <dwalsh>
Status: CLOSED NOTABUG QA Contact: atomic-bugs <atomic-bugs>
Severity: urgent Docs Contact:
Priority: urgent    
Version: 7.3CC: amurdaca, dwalsh, jhonce, mpatel, p10sonu, pasik
Target Milestone: rcKeywords: Extras, UpcomingRelease, ZStream
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2016-08-24 12:09:56 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:

Description Vivek Goyal 2016-08-22 19:10:01 UTC 
Description of problem:

If one configures overlay2 driver, looks like docker fails to run container. I can run same container with overlay driver.

# docker run -ti fedora bash
Unable to find image 'fedora:latest' locally
Trying to pull repository registry.access.redhat.com/fedora ... 
Pulling repository registry.access.redhat.com/fedora
Error: image fedora:latest not found
Trying to pull repository docker.io/library/fedora ... 
latest: Pulling from docker.io/library/fedora
2bf01635e2a0: Pull complete 
Digest: sha256:64a02df6aac27d1200c2572fe4b9949f1970d05f74d367ce4af994ba5dc3669e
Status: Downloaded newer image for docker.io/fedora:latest
bash: error while loading shared libraries: libtinfo.so.6: cannot open shared object file: Permission denied



Version-Release number of selected component (if applicable):


How reproducible:


Steps to Reproduce:
1.
2.
3.

Actual results:


Expected results:


Additional info:
Comment 2 Vivek Goyal 2016-08-22 19:14:19 UTC 
#docker run -ti fedora ls
ls: error while loading shared libraries: libselinux.so.1: cannot open shared object file: Permission denied
Comment 5 Daniel Walsh 2016-08-23 10:15:52 UTC 
Vivek, what is the output of 

ausearch -m avc -ts recent

This looks like an SELinux issue.
Comment 6 Vivek Goyal 2016-08-23 14:18:23 UTC 
Dan,

It indeed is SELinux issue. I set selinux in permissive mode and running container worked. Following is avc.

type=AVC msg=audit(1471961779.544:9632): avc:  denied  { read } for  pid=6527 comm="bash" name="libtinfo.so.6.0" dev="dm-0" ino=1363793 scontext=system_u:system_r:svirt_lxc_net_t:s0:c786,c1001 tcontext=system_u:object_r:docker_var_lib_t:s0 tclass=file
Comment 7 Vivek Goyal 2016-08-23 14:21:05 UTC 
overlay works and I see the label docker_share_t on overlay dir and its child. But overlay2 still is docker_var_lib_t and that probably is the problem.
Comment 8 Daniel Walsh 2016-08-24 12:09:56 UTC 
This looks like labeling is not working.  docker_var_lib_t is the default label of /var/lib/docker, which is not supposed to be used in docker.  Overlay and SELinux do not work together in RHEL7.  Until we get the patches in.  So your dockerd should not be run with selinux-enabled. Sadly the current patch that prevents this only looks for overlay not overlay2.
Comment 9 Vivek Goyal 2016-08-24 13:46:28 UTC 
Ok, it worked for me when I removed --selinux-enabled from /etc/sysconfig/docker-latest.

So for now, people can use it the way they use overlay. That is remove --selinux-enabled and things should work.
Comment 10 p10sonu 2017-06-26 11:05:24 UTC 
Vivek, I wonder why is this not a bug, disabled selinux can't be the fix ? Looks like I am missing something?
Comment 11 Daniel Walsh 2017-06-26 12:45:19 UTC 
p10sunu, I am the last person in the world to tell people to disable SELinux. But until the RHEL7.4 kernel ship the choice is to run SELinux with Device Mapper Back end or disable SELinux for container work loads when running Overlay.  The kernel needs to be fixed to make both run together.