Describe the enhancement or feature you would like
When using the CPython devcontainer image on SELinux-enabled Linux hosts, a plain bind mount may fail with Permission denied inside the container.
Example:
docker run -it --rm \
-v "$PWD:/workspace" \
-w /workspace \
ghcr.io/python/devcontainer:latest
In that case, a SELinux-compatible bind mount works:
docker run -it --rm \
-v "$PWD:/workspace:Z" \
-w /workspace \
ghcr.io/python/devcontainer:latest
Without relabeling, /workspace may not be readable from inside the container.
It may be helpful to add a short note to the local Docker/devcontainer documentation for SELinux-enabled hosts, preferably using the :Z bind-mount form.
Describe alternatives you have considered
As an alternative workaround, this also works:
docker run -it --rm \
--security-opt label=disable \
-v "$PWD:/workspace" \
-w /workspace \
ghcr.io/python/devcontainer:latest
Additional context
No response
Describe the enhancement or feature you would like
When using the CPython devcontainer image on SELinux-enabled Linux hosts, a plain bind mount may fail with
Permission deniedinside the container.Example:
docker run -it --rm \ -v "$PWD:/workspace" \ -w /workspace \ ghcr.io/python/devcontainer:latestIn that case, a SELinux-compatible bind mount works:
docker run -it --rm \ -v "$PWD:/workspace:Z" \ -w /workspace \ ghcr.io/python/devcontainer:latestWithout relabeling, /workspace may not be readable from inside the container.
It may be helpful to add a short note to the local Docker/devcontainer documentation for SELinux-enabled hosts, preferably using the :Z bind-mount form.
Describe alternatives you have considered
As an alternative workaround, this also works:
docker run -it --rm \ --security-opt label=disable \ -v "$PWD:/workspace" \ -w /workspace \ ghcr.io/python/devcontainer:latestAdditional context
No response