HackerReposA FIELD GUIDE TO OPEN SOURCE
ProSponsor the shelf♧ 0
← Back to top all-time
containers
container-selinux
Roff2022–2024
containers / container-selinux

container-selinux

SELinux policy files for Container Runtimes

Systems & InfrastructureLanguages & Compilers
Explore on GitHubRead Hacker News discussions
2Distinct people
4Mentions
0Explicit recommenders
295GitHub stars
REPOSITORY AT A GLANCE

What to know before exploring

What it is

SELinux policy files for Container Runtimes

GitHub

Where it is used

No documented product use has been verified yet.

What people are saying

No recommendation phrase was found in the indexed comments.

No classified warning is attached to this page. Read the discussions before treating silence as approval.

Also in these discussions

No other repository is repeatedly linked in the same discussions.

This week on Hacker News

Nov 7–Nov 14 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/14/2026, 3:56:07 PM UTC.

No direct repository links were found in the indexed HN discussions over the past seven days. Older discussions are available below.

Mentions over time

HN mentions by month4 dated mentions

Observed mentions: 2022-11-10 09:53:20 UTC to 2024-06-14 19:25:28 UTC.

012022-11-01 00:00:00 UTC to 2022-12-01 00:00:00 UTC (exclusive): 1 mentions; 0 submissions, 1 commentsNov 20222022-12-01 00:00:00 UTC to 2023-01-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2023-01-01 00:00:00 UTC to 2023-02-01 00:00:00 UTC (exclusive): 1 mentions; 0 submissions, 1 comments2023-02-01 00:00:00 UTC to 2023-03-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2023-03-01 00:00:00 UTC to 2023-04-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2023-04-01 00:00:00 UTC to 2023-05-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2023-05-01 00:00:00 UTC to 2023-06-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2023-06-01 00:00:00 UTC to 2023-07-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2023-07-01 00:00:00 UTC to 2023-08-01 00:00:00 UTC (exclusive): 1 mentions; 0 submissions, 1 comments2023-08-01 00:00:00 UTC to 2023-09-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 commentsAug 20232023-09-01 00:00:00 UTC to 2023-10-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2023-10-01 00:00:00 UTC to 2023-11-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2023-11-01 00:00:00 UTC to 2023-12-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2023-12-01 00:00:00 UTC to 2024-01-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2024-01-01 00:00:00 UTC to 2024-02-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2024-02-01 00:00:00 UTC to 2024-03-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2024-03-01 00:00:00 UTC to 2024-04-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2024-04-01 00:00:00 UTC to 2024-05-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2024-05-01 00:00:00 UTC to 2024-06-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2024-06-01 00:00:00 UTC to 2024-07-01 00:00:00 UTC (exclusive): 1 mentions; 0 submissions, 1 commentsJun 2024

Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.

View mention counts and date ranges
UTC ranges include their start and exclude their end. Select a period to filter the source evidence.
PeriodStart (UTC)End (exclusive, UTC)MentionsSubmissionsComments
Nov 20222022-11-01 00:00:00 UTC2022-12-01 00:00:00 UTC101
Dec 20222022-12-01 00:00:00 UTC2023-01-01 00:00:00 UTC000
Jan 20232023-01-01 00:00:00 UTC2023-02-01 00:00:00 UTC101
Feb 20232023-02-01 00:00:00 UTC2023-03-01 00:00:00 UTC000
Mar 20232023-03-01 00:00:00 UTC2023-04-01 00:00:00 UTC000
Apr 20232023-04-01 00:00:00 UTC2023-05-01 00:00:00 UTC000
May 20232023-05-01 00:00:00 UTC2023-06-01 00:00:00 UTC000
Jun 20232023-06-01 00:00:00 UTC2023-07-01 00:00:00 UTC000
Jul 20232023-07-01 00:00:00 UTC2023-08-01 00:00:00 UTC101
Aug 20232023-08-01 00:00:00 UTC2023-09-01 00:00:00 UTC000
Sep 20232023-09-01 00:00:00 UTC2023-10-01 00:00:00 UTC000
Oct 20232023-10-01 00:00:00 UTC2023-11-01 00:00:00 UTC000
Nov 20232023-11-01 00:00:00 UTC2023-12-01 00:00:00 UTC000
Dec 20232023-12-01 00:00:00 UTC2024-01-01 00:00:00 UTC000
Jan 20242024-01-01 00:00:00 UTC2024-02-01 00:00:00 UTC000
Feb 20242024-02-01 00:00:00 UTC2024-03-01 00:00:00 UTC000
Mar 20242024-03-01 00:00:00 UTC2024-04-01 00:00:00 UTC000
Apr 20242024-04-01 00:00:00 UTC2024-05-01 00:00:00 UTC000
May 20242024-05-01 00:00:00 UTC2024-06-01 00:00:00 UTC000
Jun 20242024-06-01 00:00:00 UTC2024-07-01 00:00:00 UTC101

What Hacker News says

4 sources
westurner·Jun 14, 2024
ChromiumOS, ChromeOS Flex, https://news.ycombinator.com/item?id=36998964 : > Students can't run `git --help`, `python`, or even `adb` on Chromebooks. > (Students can't run `git` on a Chromebook without transpiling to WASM (on a different machine) and running all apps as the same user account without SELinux or `ls -Z` on the host). > Students can run `bash`, `git`, and `python` on Linux / Mac / or Windows computers. > There should be a "Computers for STEM" spec. Docker containers can be run on Android with root with termux: - https://gist.github.com/FreddieOliveira/efe850df7ff3951cb62d... Podman and podman-desktop run rootless containers (without having root). containers/container-selinux: https://github.com/containers/container-selinux/tree/main .spec: https://src.fedoraproject.org/rpms/container-selinux/blob/ra... "The best WebAssembly
Read the rest
runtime may be no runtime" https://news.ycombinator.com/item?id=38609105 : google/minijail, SyscallFilter=, E.g. https://vscode.dev/ runs in a browser tab on a Chromebook and supports Pyodide and IIUC hopefully more native Python in WASM support soon? Hopefully Bash, Git, and e.g. Python will work offline on the kids' Chromebooks someday.
In ChromeOS will soon be developed on large portions of the Android stack
westurner·Jul 11, 2023
If LTS contracts are that lucrative, are the new Stream release models missing the market? Are there time-to-patch metrics for comparison with and without stream as compared with IDK Fedora git? Rpms/kernel explains: https://src.fedoraproject.org/rpms/kernel : > The kernel is maintained in a source tree rather than directly in dist-git. The specfile is maintained as a template in the source tree along with a set of build scripts to generate configurations, (S)RPMs, and to populate the dist-git repository. Here are fedora's kernel patches: https://gitlab.com/cki-project/kernel-ark/-/commits/ark-patc... RHEL <= 9 has kernel-lt (Long Term) and kernel-ml (mainline) kernel patchsets and packages: https://pkgs.org/search/?q=kernel-lt https://www.google.com/search?q=kernel-lt+kernel-ml Notable Red Hat Enterprise Linux derivatives: https://en.
Read the rest
wikipedia.org/wiki/Red_Hat_Enterprise_Linux_deriv... List of commercial products based on Red Hat Enterprise Linux: https://en.wikipedia.org/wiki/List_of_commercial_products_ba... There used to be a stack of numbered kernel patches in the kernel SRPM Source RPM, but now what is the best way to diff centos-stream-9's main branch with Torvalds/git:main? AFAIU kernel distributors must dist patches because GPLv2; packaging workflows are irrelevant to license terms? https://gitlab.com/redhat/centos-stream/src/kernel/centos-st... Fedora and many other distros do a lot of valued work, too. FWICS there are FIPS kernel variants for Ubuntu <= 20.04 LTS (2020) but not 22.04 LTS (2022), and Debian and Ubuntu don't have the selinux policy set that Fedora and RHEL+EPEL have. https://ubuntu.com/kernel From https://news.ycombinator.com/item?id=36480033 : > Would it be feasible to sed-replace the RHEL and/or Fedora selinux and container-selinux rulesets for use with other Linux distros? > "AFAIU only SUSE can run both AppArmor and SELinux? > And browsers are running as unconfined in selinux with like all major distros; even on ChromiumOS Act like you added `systemd-nspawn respawn` to every SysV-init script and correctly formatted the epoch time in the correct column of each of the log files to merge and then logship again. Conda-forge's GitHub PRs to feedstocks model works, but there are no grub or uboot or selinux-policy-targeted or container-selinux or kernel packages in conda-forge or Alpine linux. containers/container-selinux: https://github.com/containers/container-selinux/tree/main https://src.fedoraproject.org/rpms/container-selinux/blob/ra...
In SUSE is forking RHEL
westurner·Jan 13, 2023
Some way to indicate which "WASM contexts" (?) have utilized how much disk space would be great for open source multiple implementations not-Flash, too. From https://news.ycombinator.com/item?id=32953286 https://westurner.github.io/hnlog/#story-32950199 : > - [ ] UBY: Browsers: Vary the {color, size, fill} of the tab tabs according to their relative resource utilization And then that tabs are (sandboxed) subprocesses running as the same user though. Containers may have unique SELinux MCS labels, and browser tab processes probably should too. containers/container-selinux: https://github.com/containers/container-selinux https://github.com/kai5263499/awesome-container-security/iss... > - [ ] ENH,SEC: Browsers: specify per-tab/per-domain resource quotas: CPU, RAM, Disk, [GPU, TPU, QPU] (Linux: cgroups,) Like Flash
In SQLite Wasm in the browser backed by the Origin Private File System
yrro·Nov 10, 2022
Yeah, use ps -Z PID (from outside of a container) to check its label. Some other useful sources of info - the container_selinux man page tells you about container_t. And an index of Dan Walsh's blog posts about containers & SELinux can be found in the README of <https://github.com/containers/container-selinux>. And of course the RHEL documentation for creatign custom SELinux policies that inherit from container_t (for instance, I use it to allow processes within a container to read their certificates out of /etc/pki/tls which is normally forbidden. It's documented here: https://access.redhat.com/documentation/en-us/red_hat_enterp...
In Podman Desktop: A Free OSS Alternative to Docker Desktop

MAKE YOURSELF AT HOME

A few shortcuts

/
Search the collection
?
Open this guide
Esc
Close dialogs and navigation

Your saved repositories and interests stay in this browser.