René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"SELinux: Got permission denied while trying to connect to the Docker daemon socket at unix:///var/run/docker.sock","articleBody":"Putting this here for others.\r\n\r\n**In the runner:**\r\n```shell\r\nroot@50a4dc272487:/actions-runner# docker ps\r\nGot permission denied while trying to connect to the Docker daemon socket at unix:///var/run/docker.sock: Get http://%2Fvar%2Frun%2Fdocker.sock/v1.40/containers/json: dial unix /var/run/docker.sock: connect: permission denied\r\n```\r\n\r\n**On the host:**\r\n```shell\r\n----\r\ntime-\u003eSat Mar  7 21:21:39 2020\r\ntype=PROCTITLE msg=audit(1583616099.890:863): proctitle=646F636B6572007073\r\ntype=SYSCALL msg=audit(1583616099.890:863): arch=c000003e syscall=42 success=no exit=-13 a0=3 a1=c00056f290 a2=17 a3=0 items=0 ppid=3254 pid=3267 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=4294967295 comm=\"docker\" exe=\"/usr/bin/docker\" subj=system_u:system_r:container_t:s0:c36,c702 key=(null)\r\ntype=AVC msg=audit(1583616099.890:863): avc:  denied  { connectto } for  pid=3267 comm=\"docker\" path=\"/run/docker.sock\" scontext=system_u:system_r:container_t:s0:c36,c702 tcontext=system_u:system_r:container_runtime_t:s0 tclass=unix_stream_socket permissive=0\r\n```\r\n\r\nIf you're running the default Docker package from Centos or RH it doesn't disable SELinux at the daemon. Start the container with `--security-opt=label=disable`.\r\n\r\n```shell\r\nfunction github-runner {\r\n    name=github-runner-${1//\\//-}\r\n    org=$(dirname $1)\r\n    repo=$(basename $1)\r\n    tag=${3:-latest}\r\n    docker rm -f $name\r\n    docker run -d --restart=always \\\r\n        --security-opt=label=disable \\\r\n        -e REPO_URL=\"https://github.com/${org}/${repo}\" \\\r\n        -e RUNNER_TOKEN=\"$2\" \\\r\n        -e RUNNER_NAME=\"linux-${repo}\" \\\r\n        -e RUNNER_WORKDIR=\"/tmp/github-runner\" \\\r\n        -v /var/run/docker.sock:/var/run/docker.sock \\\r\n        -v /tmp/github-runner:/tmp/github-runner \\\r\n        --name=$name myoung34/github-runner:${tag}\r\n}\r\n```\r\n\r\nhttps://bugzilla.redhat.com/show_bug.cgi?id=1669728","author":{"url":"https://github.com/rbellamy","@type":"Person","name":"rbellamy"},"datePublished":"2020-03-07T21:50:35.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":1},"url":"https://github.com/9/docker-github-actions-runner/issues/9"}