Apply MCS label when privileged is false
@@ -122,6 +122,8 @@ func GetProcessConfig(process v3.Process, host *hosts.Host) (*container.Config,
if len(process.RestartPolicy) > 0 {
hostCfg.RestartPolicy = container.RestartPolicy{Name: process.RestartPolicy}
}
+ // The MCS label only needs to be applied when container is not running privileged, and running privileged negates need for applying the label
+ if !process.Privileged {
for _, securityOpt := range host.DockerInfo.SecurityOptions {
// If Docker is configured with selinux-enabled:true, we need to specify MCS label to allow files from service-sidekick to be shared between containers
if securityOpt == "selinux" {
@@ -142,6 +144,7 @@ func GetProcessConfig(process v3.Process, host *hosts.Host) (*container.Config,
}
}
}
+ }
return imageCfg, hostCfg, process.HealthCheck.URL
}
