Startup problems on systems using SELinux (e.g. Fedora)

[RobotLeopard86]

Preamble

First off, I just wanted to say thank you, Mathew, for creating this amazing project. It's really cool! That said, I'd like to report a bug so that you can make CodeRunner even better and easier to use.

System

OS: Fedora Linux 44
Arch: x86_64
Docker: 29.7.2
Docker Compose: 2.27.1

Issue

On systems such as mine that ship with SELinux enabled, the container fails to start when following the instructions in the online local deployment guide here. Both of these failures occur before the web server is ready, which causes the healthz check in the guide to fail, saying that it couldn't connect. Two primary problems manifest here:

1. SELinux blocks container access to the data directory containing the SQLite database that the container attempts to open.
2. SELinux blocks the control plane container from managing student containers

Fixes

As a note, I would open this as a PR, but I really don't want to take the time to configure a fork because it's only a few changes to docker-compose.yml.

Anyways, these two issues can be resolved by applying the following Git patch:

diff --git a/data/.gitkeep b/data/.gitkeep
deleted file mode 100644
index e69de29..0000000
diff --git a/docker-compose.yml b/docker-compose.yml
index 958c655..6f00da0 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -54,7 +54,7 @@ services:
       - /var/run/docker.sock:/var/run/docker.sock
       # Compose resolves ./ against the project directory. Set
       # CODERUNNER_HOST_DATA_DIR to relocate the data dir (e.g. a mounted disk).
-      - ${CODERUNNER_HOST_DATA_DIR:-./data}:/data
+      - ${CODERUNNER_HOST_DATA_DIR:-./data}:/data:Z
     environment:
       CODE_IMAGE: ${CODERUNNER_IMAGE_NS:-ghcr.io/mathewdunne}/coderunner-workspace:${CODERUNNER_TAG:-latest}
       # Demo mode: auth bypassed, everyone shares one admin workspace. Unset
@@ -72,6 +72,8 @@ services:
       timeout: 3s
       retries: 5
       start_period: 20s
+    security_opt:
+      - label=disable
 
   # Pull-only helper: the workspace image is started by the control plane via
   # the Docker CLI, not by compose, so this stub makes `docker compose pull`

Conclusion

I hope the information provided here was informative and that this issue can be fixed relatively quickly. Again, thank you so much for creating CodeRunner. I'm happy to answer any further questions you may have about this issue.

[RobotLeopard86]

Update: while doing further testing, I found another problem with SELinux. This one was preventing the student workspace container from actually seeing its own project files due to bad permissions. Again, the fix was to ensure that SELinux is properly configured for the bind mounts.

Applying the below Git patch resolves this issue as well:

diff --git a/apps/control/src/containers/local-docker-runtime-provider.ts b/apps/control/src/containers/local-docker-runtime-provider.ts
index 83d3068..a63f76c 100644
--- a/apps/control/src/containers/local-docker-runtime-provider.ts
+++ b/apps/control/src/containers/local-docker-runtime-provider.ts
@@ -641,12 +641,10 @@ export class LocalDockerRuntimeProvider implements WorkspaceRuntimeProvider {
                        // Mount sources are resolved by the Docker daemon against the HOST
                        // filesystem, so they go through toHostPath (a no-op outside the
                        // containerized deployment).
-                       "--mount",
-                       `type=bind,src=${toHostPath(config, workspace.project_path)},dst=/workspace/project`,
-                       "--mount",
-                       configVolume
-                               ? `type=volume,src=${configVolume},dst=/config`
-                               : `type=bind,src=${toHostPath(config, homePath)},dst=/config`,
+                       "-v",
+                       `${toHostPath(config, workspace.project_path)}:/workspace/project:z`,
+                       "-v",
+                       `${toHostPath(config, homePath)}:/config:z`,
                ];
 
                // Nest workspace containers under the control plane's compose project in

[mathewdunne]

Thanks for tracking this down and testing the fixes! The linked PR follows your approach: it adds label=disable to the control container and :z to the student bind mounts.

I kept demo mode’s /config named volume, which avoids slow filesystem access on Docker Desktop. I also left :Z off the control plane’s data mount since it’s unnecessary with labeling disabled, and kept data/.gitkeep so fresh clones retain the directory and Docker doesn’t create it as root.

The automated tests pass, but I haven’t verified this on an enforcing SELinux host. A check of both demo and normal mode on your Fedora setup would be really helpful!

Key changes

--- a/docker-compose.yml
+++ b/docker-compose.yml
@@
     group_add:
       - "${CODERUNNER_DOCKER_GID:-0}"
+    security_opt:
+      - label=disable

--- a/apps/control/src/containers/local-docker-runtime-provider.ts
+++ b/apps/control/src/containers/local-docker-runtime-provider.ts
@@
-                       "--mount",
-                       `type=bind,src=${toHostPath(config, workspace.project_path)},dst=/workspace/project`,
-                       "--mount",
+                       "-v",
+                       `${toHostPath(config, workspace.project_path)}:/workspace/project:z`,
+                       configVolume ? "--mount" : "-v",
                        configVolume
                                ? `type=volume,src=${configVolume},dst=/config`
-                               : `type=bind,src=${toHostPath(config, homePath)},dst=/config`,
+                               : `${toHostPath(config, homePath)}:/config:z`,

Abbreviated to show the functional changes; the PR also includes comments, updated tests, and a decision log.

[mathewdunne]

@RobotLeopard86 I created a tag from that branch to let you test locally before I merge. If you have time, please try the following:

From your existing CodeRunner checkout, save any local patches first, then:

git fetch origin --tags
git switch 17-startup-problems-on-systems-using-selinux-eg-fedora
git pull --ff-only origin 17-startup-problems-on-systems-using-selinux-eg-fedora

Set this in your existing .env, preserving your other settings:

CODERUNNER_TAG=v0.6.1-selinux-fix

Then pull and recreate:

docker compose pull
docker compose up -d --wait
docker compose exec control coderunner rebuild-workspaces
curl -fsS http://localhost:4000/healthz

Reopen the workspace, load a lesson, and try Run.

Note: rebuilding disconnects active editors but preserves project files.

For demo mode, set CODERUNNER_DEMO_MODE=1 in .env before running these commands.

If you run into any issues, let me know!

[RobotLeopard86]

Hi @mathewdunne,

I have tested the v0.6.1-selinux-fix on my Fedora system and can confirm that it is working! Thank you for being so responsive and for fixing this.

[mathewdunne]

@RobotLeopard86 awesome happy to help! thanks for raising the issue!

[mathewdunne]

@RobotLeopard86 I just merged and created a v0.6.2 tag or you can just go back to using "latest"

[RobotLeopard86]

Thank you!