D4M 17.04.0-ce-rc2-mac6 (16165): Volume labels no longer accepted in stack file #32579

briantd · 2017-04-12T22:30:45Z

Description
Docker stack deploy throws errors when encountering volume labels.
This error surfaced when I upgraded to 17.04.0-ce-rc2-mac6 (16165). Rolling back to stable fixes the problem. I've opened this issue in the D4M project, and they diagnosed it as a docker/docker issue.

docker stack deploy --with-registry-auth -c docker-compose.yml my_app
1 error(s) decoding:
invalid spec: /var/run/docker.sock:/var/run/docker.sock:z: unknown option: z

The previous version of Beta worked, as does the current version of Stable.
Version 17.03.1-ce-mac5 (16048)
Channel: stable
b18e2a50cc

Documentation still shows volume labels as a supported feature:
https://docs.docker.com/engine/tutorials/dockervolumes/#volume-labels

Steps to reproduce the issue:
The following docker command should be able to launch a stack with volumes that have volume labels

docker stack deploy -c docker-compose.yml my_app
e.g.

services:
  # Docker Swarm visualizer
  # See https://docs.docker.com/engine/tutorials/dockervolumes/#volume-labels for info on the ":z"
  viz:
    image: manomarks/visualizer
    ports:
      - 8081:8080
    networks:
      - jenkins-net
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:z
    deploy:
      placement:
        constraints: [node.role==manager]

Describe the results you received:
1 error(s) decoding:

invalid spec: /var/run/docker.sock:/var/run/docker.sock:z: unknown option: z

Describe the results you expected:
A successfully deployed stack

Additional information you deem important (e.g. issue happens only occasionally):

Issue raised in 2 other forums, I was directed to raise the issue here:
https://github.com/docker/editions/issues/1006
docker/for-mac#1519

Output of docker version:

Client:
 Version:      17.04.0-ce
 API version:  1.28
 Go version:   go1.7.5
 Git commit:   4845c56
 Built:        Wed Apr  5 06:06:36 2017
 OS/Arch:      darwin/amd64

Server:
 Version:      17.04.0-ce
 API version:  1.28 (minimum version 1.12)
 Go version:   go1.7.5
 Git commit:   4845c56
 Built:        Tue Apr  4 00:37:25 2017
 OS/Arch:      linux/amd64
 Experimental: true

Output of docker info:

Containers: 0
 Running: 0
 Paused: 0
 Stopped: 0
Images: 0
Server Version: 17.04.0-ce
Storage Driver: overlay2
 Backing Filesystem: extfs
 Supports d_type: true
 Native Overlay Diff: true
Logging Driver: json-file
Cgroup Driver: cgroupfs
Plugins:
 Volume: local
 Network: bridge host ipvlan macvlan null overlay
Swarm: inactive
Runtimes: runc
Default Runtime: runc
Init Binary:
containerd version: 422e31ce907fd9c3833a38d7b8fdd023e5a76e73
runc version: 9c2d8d184e5da67c95d601382adf14862e4f2228
init version: 949e6fa
Security Options:
 seccomp
  Profile: default
Kernel Version: 4.9.19-moby
Operating System: Alpine Linux v3.5
OSType: linux
Architecture: x86_64
CPUs: 4
Total Memory: 1.952GiB
Name: moby
ID: 2OCU:DGH2:6HS3:YPAB:LUEB:MZ7S:FUYZ:SVI6:R2FE:Z4EY:5LWQ:7VCR
Docker Root Dir: /var/lib/docker
Debug Mode (client): false
Debug Mode (server): true
 File Descriptors: 16
 Goroutines: 26
 System Time: 2017-04-12T22:26:58.076470584Z
 EventsListeners: 1
No Proxy: *.local, 169.254/16
Registry: https://index.docker.io/v1/
Experimental: true
Insecure Registries:
 127.0.0.0/8
Live Restore Enabled: false

briandonaldson@Br

Additional environment details (AWS, VirtualBox, physical, etc.):
OSX 10.12.4, Macbook Pro 15"

The text was updated successfully, but these errors were encountered:

vieux · 2017-04-12T23:31:58Z

/cc @dnephin

dnephin · 2017-04-13T14:59:02Z

In previous versions there was no error, but they were being ignored. The swarm mode mount definition does not support these flags.

We could continue to ignore them, and warn they are being ignored, instead of returning an error.

briantd · 2017-04-13T18:15:10Z

Please continue to ignore, or better yet, ignore+warn; throwing an error breaks existing stack files.

Also, this behavior should be called out in the documentation. There's no mention of swarm-specific expectations:
https://docs.docker.com/engine/tutorials/dockervolumes/#volume-labels

cpuguy83 · 2017-04-13T22:52:02Z

I'm pretty sure swarm mode supports these in "VolumeOptions"

dnephin · 2017-04-13T23:03:11Z

@cpuguy83 :z is different from a "dockers label" right? I see they're both being called "volume labels", but I thought they were different things.

I think VolumeOptions only has "docker labels"

cpuguy83 · 2017-04-13T23:21:26Z

Oh yes, you are right. We don't support selinux relabeling in swarm mode.

stevvooe · 2017-05-10T23:50:10Z

Aren't these for bind propagation? Swarmkit handles them explicitly: https://github.com/docker/swarmkit/blob/master/agent/exec/dockerapi/container.go#L290.

cpuguy83 · 2017-05-11T00:08:21Z

z and Z are for selinux.

stevvooe · 2017-05-11T00:16:33Z

@cpuguy83 We should almost just pass these through directly...

cpuguy83 · 2017-05-11T00:17:34Z

@stevvooe It was a conscious decision to not support these at the time because it actually modifies the host path.

briantd · 2017-06-30T22:45:28Z

I recently updated my D4M and noticed the "invalid spec" error again.

$ docker version
Client:
 Version:      17.06.0-ce
 API version:  1.26 (downgraded from 1.30)
 Go version:   go1.8.3
 Git commit:   02c1d87
 Built:        Fri Jun 23 21:31:53 2017
 OS/Arch:      darwin/amd64

AhmedAnwarM · 2021-01-28T12:00:22Z

I know this was 4 years ago, but I'm facing this issue now and looking for advise.
What is the best practice here? I am using docker swarm and I need to mount a volume for logs, config, etc.

thaJeztah · 2021-01-28T14:28:25Z

For config, use swarm configs: https://docs.docker.com/engine/swarm/configs/

For logs; make sure the container sends logs to stdout/stderr, so that they're captured by docker's logging drivers

ducttapecoder-vt · 2021-03-01T23:10:44Z

@thaJeztah What is the best practice for larger non-config mounts (such as the TSDB for prometheus?) I generally prefer bind mounts to volumes due to the simplicity of working with them but it seems like it will be necessary to switch to a volume when working with persistent storage in docker swarm services.

@cpuguy83 Can you elaborate on the background of the decision not to support SELinux tags in services?

cpuguy83 · 2021-03-01T23:23:57Z

@ducttapecoder-vt Because the settings are not namespaced. It happens on the host, directly to those files records.

What is the best practice here?

Set the selinux labels on the host.

thaJeztah · 2024-05-31T20:40:46Z

closing this one, as this was an intentional change (see above)

GordonTheTurtle added area/swarm version/17.04 labels Apr 12, 2017

briantd mentioned this issue Apr 12, 2017

docker stack deploy no longer supports volume-labels docker/for-mac#1519

Closed

GordonTheTurtle added area/swarm version/17.04 labels Apr 12, 2017

briantd mentioned this issue Apr 13, 2017

selinux labels are not used by bind mounts in swarm mode docker/docs#2763

Closed

catthehacker mentioned this issue Mar 8, 2021

Issue: Unable to execute docker build within a Github Action workflow nektos/act#556

Closed

djnotes mentioned this issue Jun 25, 2021

SELinux blocks bind mount with Docker Compose containers/podman#10779

Closed

ThePromidius mentioned this issue Sep 3, 2022

Can't get latest or unstable to run Banh-Canh/docker-FMD2#7

Open

krnowak mentioned this issue Sep 15, 2022

kola/tests/devcontainer: New test flatcar/mantle#367

Merged

1 task

fierlion mentioned this issue Oct 11, 2022

[ECS] [Feature Request]: Enable z (lower case z) mounting option for ECS. aws/containers-roadmap#1857

Open

bwateratmsft mentioned this issue Oct 18, 2022

Removal of SELinux relable options microsoft/vscode-docker#3656

Closed

matmair mentioned this issue Feb 19, 2023

Support podman and selinux for dev setup inventree/InvenTree#4354

Merged

This comment was marked as spam.

Sign in to view

thaJeztah closed this as completed May 31, 2024

stasadev mentioned this issue Apr 10, 2025

Error: cp: cannot access '/mnt/ddev_config/nginx_full': Permission denied; Fedora with SELinux ddev/ddev#7196

Closed

4 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

D4M 17.04.0-ce-rc2-mac6 (16165): Volume labels no longer accepted in stack file #32579

D4M 17.04.0-ce-rc2-mac6 (16165): Volume labels no longer accepted in stack file #32579

briantd commented Apr 12, 2017 •

edited

Loading

vieux commented Apr 12, 2017

dnephin commented Apr 13, 2017

briantd commented Apr 13, 2017 •

edited

Loading

cpuguy83 commented Apr 13, 2017

dnephin commented Apr 13, 2017

cpuguy83 commented Apr 13, 2017

stevvooe commented May 10, 2017

cpuguy83 commented May 11, 2017

stevvooe commented May 11, 2017

cpuguy83 commented May 11, 2017

briantd commented Jun 30, 2017

AhmedAnwarM commented Jan 28, 2021

thaJeztah commented Jan 28, 2021

ducttapecoder-vt commented Mar 1, 2021

cpuguy83 commented Mar 1, 2021

This comment was marked as spam.

This comment was marked as spam.

thaJeztah commented May 31, 2024

D4M 17.04.0-ce-rc2-mac6 (16165): Volume labels no longer accepted in stack file #32579

D4M 17.04.0-ce-rc2-mac6 (16165): Volume labels no longer accepted in stack file #32579

Comments

briantd commented Apr 12, 2017 • edited Loading

vieux commented Apr 12, 2017

dnephin commented Apr 13, 2017

briantd commented Apr 13, 2017 • edited Loading

cpuguy83 commented Apr 13, 2017

dnephin commented Apr 13, 2017

cpuguy83 commented Apr 13, 2017

stevvooe commented May 10, 2017

cpuguy83 commented May 11, 2017

stevvooe commented May 11, 2017

cpuguy83 commented May 11, 2017

briantd commented Jun 30, 2017

AhmedAnwarM commented Jan 28, 2021

thaJeztah commented Jan 28, 2021

ducttapecoder-vt commented Mar 1, 2021

cpuguy83 commented Mar 1, 2021

This comment was marked as spam.

This comment was marked as spam.

thaJeztah commented May 31, 2024

briantd commented Apr 12, 2017 •

edited

Loading

briantd commented Apr 13, 2017 •

edited

Loading