Docker Cookbook - Second Edition

Setting Mandatory Access Control (MAC) with SELinux

It is recommended that you set up some form of MAC on the Docker host, either through SELinux or AppArmor, depending on the Linux distribution. In this recipe, we'll see how to set up SELinux on a Fedora/RHEL/CentOS installed system. Let's first look at what SELinux is:

• SELinux is a labeling system
• Every process has a label
• Every file, directory, and system object has a label
• Policy rules control access between labeled processes and labeled objects
• The kernel enforces the rules

With Docker containers, we use two types of SELinux enforcement:

• Type enforcement: This is used to protect the host system from container processes. Each container process is labeled svirt_lxc_net_t, and each container ...