From f09b5de6c289a5e0c41e625406f7d5c80d66dbe8 Mon Sep 17 00:00:00 2001 From: Roman Priesol Date: Sat, 12 Sep 2026 01:27:23 +0200 Subject: [PATCH] Relabel data bind mounts for SELinux (:Z) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit App crashed on startup on brick (Permission denied @ dir_s_mkdir - /app/data/gpx) — brick has SELinux enforcing, unlike cube, and Podman denies a container write access to a bind-mounted host directory without a relabel regardless of Unix permissions. Applied to both maptool's ./data mount and kiwix's ZIM mount (same underlying cause, would have hit this too once a real ZIM is placed there). --- docker-compose.yaml | 10 ++++++++-- docs/deployment.adoc | 7 +++++++ 2 files changed, 15 insertions(+), 2 deletions(-) diff --git a/docker-compose.yaml b/docker-compose.yaml index d86f454..b4b8e93 100644 --- a/docker-compose.yaml +++ b/docker-compose.yaml @@ -65,7 +65,12 @@ services: # happens outside this mount, in the container's own filesystem — a # large country's .osm.pbf plus Planetiler's working set can be # several GB, worth knowing if the host is ever short on space there. - - ./data:/app/data + # :Z (not :z — this path is only ever mounted into this one + # container) relabels the host directory for SELinux, since Podman + # on an SELinux-enforcing host otherwise denies the container write + # access to a bind-mounted directory regardless of Unix permissions + # — harmless/ignored on a host without SELinux. + - ./data:/app/data:Z # Fakes a GNSS fix (a loop around Bratislava, see # bin/gnss_simulator.rb/docs/development.adoc) since there's no real @@ -118,4 +123,5 @@ services: # ever talks to this container directly. command: ["--urlRootLocation=/kiwix", "/data/wikipedia.zim"] volumes: - - ./data/kiwix/wikipedia.zim:/data/wikipedia.zim + # :Z, same SELinux reasoning as maptool's own ./data mount above. + - ./data/kiwix/wikipedia.zim:/data/wikipedia.zim:Z diff --git a/docs/deployment.adoc b/docs/deployment.adoc index d2a509c..d59311b 100644 --- a/docs/deployment.adoc +++ b/docs/deployment.adoc @@ -55,6 +55,13 @@ expect this to flip the other way, `/srv/docker` symlinked to only holds what's checked into this public repo, and gets wiped and replaced by the checkout sync on every deploy same as the rest of `build/`. + `data/` (and the kiwix ZIM path) carries a `:Z` SELinux relabel in + `docker-compose.yaml`'s bind mounts — without it, Podman on an + SELinux-enforcing host denies the container write access to the + bind-mounted directory regardless of its Unix permissions (surfaces + as a plain `Permission denied` in the app's own logs, nothing + SELinux-labeled unless you go looking in `audit.log`); harmless/ + ignored on a host where SELinux isn't enforcing. * `.env` — regenerated every deploy (see below), lives here rather than in `build/` for the same reason as the symlink: `docker compose`/`podman compose` auto-load `.env` from the compose file's