Skip to content

SELinux: Mount image using different contexts #1994

New issue
New issue
Closed
Closed
SELinux: Mount image using different contexts#1994
@saschagrunert

Description

@saschagrunert
saschagrunert
opened on Jul 2, 2024

The OCI Volume Source Kubernetes enhancement (https://kep.k8s.io/4639) will require CRI-O to mount images on container creation. The pull itself will not change from a runtime perspective, but we need to use the existing MountImage API to create an OCI mount from the host path to the workload destination.

storage/store.go

Lines 259 to 262 in 52b643e

// MountImage mounts an image to temp directory and returns the mount point.
// MountImage allows caller to mount an image. Images will always
// be mounted read/only
MountImage(id string, mountOptions []string, mountLabel string) (string, error)

The API supports passing a mountLabel, but multiple containers could request the same image mount using different labels.

Would it make sense to extend the API to have a unique mount path per SELinux context?

cc @mrunalp @haircommander

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions