[0.10 backport] Make SELinux labels opt-in (--oci-worker-selinux=<BOOL>)

[AkihiroSuda]

Cherry-pick

• worker: move labels const to its own package #3014
• Make SELinux labels opt-in (--oci-worker-selinux=<BOOL>) #3203

Cherry-picking #3203 was not clean, and resolved by removing NetworkProviders: np

$ git cherry-pick -xsS bd57e5f6b8d0f9583c1f20cbe4867b0138848920
Auto-merging cmd/buildkitd/config/config.go
Auto-merging cmd/buildkitd/main_containerd_worker.go
Auto-merging cmd/buildkitd/main_oci_worker.go
Auto-merging executor/containerdexecutor/executor.go
Auto-merging executor/runcexecutor/executor.go
Auto-merging worker/containerd/containerd.go
CONFLICT (content): Merge conflict in worker/containerd/containerd.go
Auto-merging worker/containerd/containerd_test.go
Auto-merging worker/runc/runc.go
Auto-merging worker/runc/runc_test.go
error: could not apply bd57e5f6... Make SELinux labels opt-in (`--oci-worker-selinux=<BOOL>`)
hint: After resolving the conflicts, mark them with
hint: "git add/rm <pathspec>", then run
hint: "git cherry-pick --continue".
hint: You can instead skip this commit with "git cherry-pick --skip".
hint: To abort and get back to the state before "git cherry-pick",
hint: run "git cherry-pick --abort".

$ git diff
diff --cc worker/containerd/containerd.go
index 7ccb8174,a829d457..00000000
--- a/worker/containerd/containerd.go
+++ b/worker/containerd/containerd.go
@@@ -131,20 -133,21 +133,38 @@@ func newContainerd(root string, client 
        }
  
        opt := base.WorkerOpt{
++<<<<<<< HEAD
 +              ID:             id,
 +              Labels:         xlabels,
 +              MetadataStore:  md,
 +              Executor:       containerdexecutor.New(client, root, "", np, dns, apparmorProfile, traceSocket, rootless),
 +              Snapshotter:    snap,
 +              ContentStore:   cs,
 +              Applier:        winlayers.NewFileSystemApplierWithWindows(cs, df),
 +              Differ:         winlayers.NewWalkingDiffWithWindows(cs, df),
 +              ImageStore:     client.ImageService(),
 +              Platforms:      platforms,
 +              LeaseManager:   lm,
 +              GarbageCollect: gc,
 +              ParallelismSem: parallelismSem,
 +              MountPoolRoot:  filepath.Join(root, "cachemounts"),
++=======
+               ID:               id,
+               Labels:           xlabels,
+               MetadataStore:    md,
+               NetworkProviders: np,
+               Executor:         containerdexecutor.New(client, root, "", np, dns, apparmorProfile, selinux, traceSocket, rootless),
+               Snapshotter:      snap,
+               ContentStore:     cs,
+               Applier:          winlayers.NewFileSystemApplierWithWindows(cs, df),
+               Differ:           winlayers.NewWalkingDiffWithWindows(cs, df),
+               ImageStore:       client.ImageService(),
+               Platforms:        platforms,
+               LeaseManager:     lm,
+               GarbageCollect:   gc,
+               ParallelismSem:   parallelismSem,
+               MountPoolRoot:    filepath.Join(root, "cachemounts"),
++>>>>>>> bd57e5f6 (Make SELinux labels opt-in (`--oci-worker-selinux=<BOOL>`))
        }
        return opt, nil
  }

[tonistiigi]

I don't think this qualifies for backport. Doesn't look like a regression fix or critical bugfix.

Also, there are no more v0.10 releases planned atm.

[AkihiroSuda]

I don't think this qualifies for backport. Doesn't look like a regression fix or critical bugfix.

This PR is critical for running BuildKit on SELinux-enabled hosts such as Fedora and EL:

• Rootful BuildKit + SELinux: Dockerfile RUN command throws error code 139 containers/container-selinux#187
• BuildKit: denied { write } (scontext=system_u:system_r:container_t:s0:c23,c164 tcontext=unconfined_u:object_r:container_ro_file_t:s0) containers/container-selinux#190

(Regression since d9834f8)

Some workarounds are added in containers/container-selinux#193, but the container-selinux side workarounds still do not work with RUN --mount=type=secret, etc. ( see containers/container-selinux#193 (comment) )

(Also it will take long until the container-selinux update gets delivered into EL users)

Also, there are no more v0.10 releases planned atm.

Any chance to reconsider this ? 🙏

[tonistiigi]

(Regression since d9834f8)

That means it was already in v0.9 . If this affects dockerd vendor then it could be a regression as that is an update from v0.8, but I don't think it does.

Any chance to reconsider this ?

I think we should push for a new feature release instead

[AkihiroSuda]

This is a regression in v0.9 for non-Docker standalone buildkitd

I think we should push for a new feature release instead

Is there an ETA?

[tonistiigi]

Is there an ETA?

Hopefully rc in ~2 weeks. From our side, we are ready when sbom/provenance PRs get in. Still hoping for that Dockerfile.pin PR though.

[AkihiroSuda]

The pin PR is not for v0.11 sorry