fedora-silverblue

#12 SELinux prevents rootless containers from running
Closed by fansari. Opened by fansari.

Closed
Reopen Issue

I have an issue with Fedora Silverblue 29.

Rootless containers are preventing from starting by SELinux.

The problem started after I formatted the volume where I put my containers with xfs . With btrfs I did not have this issue (but I am not sure whether the file systems is really the problem or this might be a coincidence).

When I do

setsebool -P virt_sandbox_use_fusefs on

the issue is fixed. But after a reboot this change is gone.

How can I fix this permanently (without any local oneshot systemd hack)?

I want to add: when I run the setsebool command I get these messages:

libsepol.context_from_record: type pcp_plugin_exec_t is not defined
libsepol.context_from_record: could not create context structure
libsepol.context_from_string: could not create context structure
libsepol.sepol_context_to_sid: could not convert system_u:object_r:pcp_plugin_exec_t:s0 to sid
invalid context system_u:object_r:pcp_plugin_exec_t:s0

I got a hint here:
https://github.com/containers/libpod/issues/2245#issuecomment-484153269

After I rebased to F30 I have container-selinux-2.95-1.gite3ebc68.fc30.noarch which still has this problem.

My temporay fix is:

[Unit]
Description=setsebool for podman
[Service]
Type=simple
ExecStart=/usr/sbin/setsebool virt_sandbox_use_fusefs on
[Install]
WantedBy=multi-user.target

I have reinstalled my system. This does not appear anymore.

Metadata Update from @fansari:
- Issue status updated to: Closed (was: Open)
Metadata
None
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.