docs: add SELinux/RHEL notice to container quick start#466
Conversation
Users on RHEL, Fedora, and other SELinux-enforcing systems hit Permission denied and dubious ownership errors when following the Quick Start examples. The fix is documented in the Podman Rootless Mode section but there was no indication to look there. Added callouts to both README.md and CONTAINER.md Quick Start sections. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
📝 WalkthroughWalkthroughQuick Start and examples in CONTAINER.md and README.md now append SELinux relabeling ( ChangesPodman SELinux volume mounts
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
✨ Simplify code
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
aegeiger
left a comment
aegeiger
left a comment
There was a problem hiding this comment.
Instead of this comment I'd suggest editing the command itself. -v /path/to/repo:/repo:ro,Z -v ~/agentready-reports:/reports:Z
|
@aegeiger Good point, just worth noting that the :z / :Z flags only apply when SELinux is enabled and enforcing, and are simply ignored on systems without it. That's actually the reason I suggested linking to the relevant documentation section, it gives users the context to decide whether these options apply to their environment and Linux OS setup. |
|
@aviavraham on systems without SELinux this flag is silently ignored without harm, so IMHO we should advise everyone to run it. Tested on macOS. |
|
Agree, I will update the MR |
Per review feedback, add SELinux :Z labels directly to the podman run volume mounts. The flag is silently ignored on non-SELinux systems, making it safe as the default for all users. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@CONTAINER.md`:
- Around line 16-17: Several remaining Podman bind-mount examples in
CONTAINER.md still omit SELinux mount labels and can fail for SELinux-enforcing
users; update every occurrence of the Podman bind-mount examples (the lines
using "podman run -v ..." and the earlier sample mounts like "-v
/path/to/repo:/repo" or "-v ~/agentready-reports:/reports") to append the
appropriate SELinux label (:z or :Z) consistent with the Quick Start fix, or add
a short note next to each Podman example explaining to use :z/:Z for SELinux,
ensuring all Podman run -v examples are updated consistently.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Enterprise
Run ID: e305352d-41f0-4915-94ee-5fa73921c2ad
📒 Files selected for processing (2)
CONTAINER.mdREADME.md
📉 Test Coverage Report
Coverage calculated from unit tests only |
jwm4
left a comment
jwm4
left a comment
There was a problem hiding this comment.
Review by Bill Murdock (with assistance from Claude Code)
Verdict: Request changes
Good idea to make the Quick Start work out of the box on SELinux systems.
Inconsistent :z vs :Z casing
The PR adds uppercase :Z to the Quick Start examples, but the existing "Podman Rootless Mode" and "Troubleshooting: Permission denied" sections in CONTAINER.md use lowercase :z. The file also has a "Note on SELinux Labels" section explaining the difference between the two. Could you make sure the choice is intentional and consistent, or explain why the Quick Start should use a different variant than the rest of the file?
Other examples
Several other podman run -v examples in CONTAINER.md don't have either flag. Is there a reason the fix should be limited to Quick Start, or should it apply more broadly?
|
@jwm4, you're right, let me review the container document and update the needed commands |
…amples Standardize on :z (shared label) instead of :Z (private label) for all podman volume mounts. Adds :z to examples that previously had no SELinux label. Docker/CI examples left unchanged as SELinux labels are Podman-specific.
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@CONTAINER.md`:
- Around line 230-231: Update the example host mount paths in the
troubleshooting Docker volume flags so they are copy/paste-safe: replace the
literal "/repo" in the "-v /repo:/repo:ro,z" entry with a real-host-path
placeholder like "$(pwd)" or "/path/to/repo", and replace the
"~/agentready-reports" in "-v ~/agentready-reports:/reports:z" with an absolute
path (e.g., "$HOME/agentready-reports" or "/path/to/reports") so users won't get
errors when running the shown docker command.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Enterprise
Run ID: 677b39ea-4515-46dd-aa0b-9c5104750773
📒 Files selected for processing (2)
CONTAINER.mdREADME.md
| -v /repo:/repo:ro,z \ | ||
| -v ~/agentready-reports:/reports:z \ |
There was a problem hiding this comment.
Fix host mount path in troubleshooting example
Line 230 uses /repo as the host source (-v /repo:/repo:ro,z), which will fail for most users unless they happen to have that exact host directory. Use a real host path pattern here (e.g., $(pwd) or /path/to/repo) to keep this command copy/paste-safe.
Suggested doc fix
podman run --rm \
- -v /repo:/repo:ro,z \
+ -v $(pwd):/repo:ro,z \
-v ~/agentready-reports:/reports:z \
ghcr.io/ambient-code/agentready:latest \
assess /repo --output-dir /reports📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| -v /repo:/repo:ro,z \ | |
| -v ~/agentready-reports:/reports:z \ | |
| podman run --rm \ | |
| -v $(pwd):/repo:ro,z \ | |
| -v ~/agentready-reports:/reports:z \ | |
| ghcr.io/ambient-code/agentready:latest \ | |
| assess /repo --output-dir /reports |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@CONTAINER.md` around lines 230 - 231, Update the example host mount paths in
the troubleshooting Docker volume flags so they are copy/paste-safe: replace the
literal "/repo" in the "-v /repo:/repo:ro,z" entry with a real-host-path
placeholder like "$(pwd)" or "/path/to/repo", and replace the
"~/agentready-reports" in "-v ~/agentready-reports:/reports:z" with an absolute
path (e.g., "$HOME/agentready-reports" or "/path/to/reports") so users won't get
errors when running the shown docker command.
jwm4
left a comment
jwm4
left a comment
There was a problem hiding this comment.
Review by Bill Murdock (with assistance from Claude Code)
Thanks for the update, @aviavraham. The latest commit addresses both concerns: consistent lowercase :z across all examples, and coverage extended beyond just Quick Start. LGTM.
|
🎉 This PR is included in version 2.45.0 🎉 The release is available on GitHub release Your semantic-release bot 📦🚀 |
3 participants
Summary
README.mdandCONTAINER.mdwarning RHEL/Fedora/SELinux users that the default commands will fail:zlabels,--userns=keep-id,GIT_CONFIG_*env vars)Context
Following the Quick Start container examples on a Fedora system with SELinux enforcing results in
Permission deniedanddubious ownershiperrors. The fix already exists in the Podman Rootless Mode section, but there's no indication in the Quick Start to look there — users hit a wall with no guidance.Test plan
#podman-rootless-moderesolves correctly in CONTAINER.mdCONTAINER.md#podman-rootless-moderesolves from README.md🤖 Generated with Claude Code
Summary by CodeRabbit