15

Recently I installed Docker CE on my Oracle Linux.
Unfortunately, when I want to start my first container with:

docker run hello-world

I get this error message:

docker: Error response from daemon: OCI runtime create failed: container_linux.go:345: starting container process caused "process_linux.go:430: container init caused \"write /proc/self/attr/keycreate: permission denied\"": unknown. ERRO[0000] error waiting for container: context canceled

1

5 Answers 5

28

Per the bug that david-maze linked to, updating container-selinux should fix this for you:

sudo yum install http://mirror.centos.org/centos/7/extras/x86_64/Packages/container-selinux-2.107-1.el7_6.noarch.rpm
3
  • 1
    Just adding: Even though the package comes from centOS, you can manually install (yum install http://...) it without risk. But: Do not add a centOS repo to /etc/yum.repos.d/ because this will cause issues.
    – o0x258
    Aug 16, 2019 at 10:33
  • I think this one is accepted answer instead of disable selinux completely.
    – ikandars
    Oct 8, 2019 at 2:59
  • 1
    Working like a charm... Thanks a lot buddy Jan 8, 2020 at 10:42
18

OP, I just ran into this issue. I am not sure what your OL support level is. But to stay supported, you really don't want to use the container-selinux from another distro. What I found as a work around is to set the following:

sudo semanage permissive -a container_runtime_t

After setting that to permissive running containers worked as expected.

2
  • 1
    Nice. This resolved my issue. Thank you so much. i was afraid before running the command. what is this command about? Jan 24, 2020 at 14:10
  • 1
    Basically disables SELinux protection for the Docker Daemon
    – mkst
    Jun 11, 2020 at 14:21
1

Another approach to solve this issue is to run docker with privileged: true. Note that this flag, gives docker containers access to everything the host is doing i.e to all the devices, mounts and networks. So use it with caution.

Another approach is set to set make sure to set "selinux-enabled": trueinside your daemon.json. This will make sure the docker knows that selinux is enabled on your system and uses the correct labels when starting the container. More info

1

I was also facing the same issue, but I have solve the problem by this way. if you are not the root, close the selinux by this command:

sudo setenforce 0

then docker run ...

0

I was also facing the same issue while trying to run docker inside lxd (linux container). I tried following flag while creating container.

security.nesting=true

Example: lxc launch ubuntu:x docker -c security.nesting=true

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.