works for me

tested with kube cluster

Works for me.

Since installing this update, my docker-compose apps can no longer run programs that are bind-mounted from /usr/local/src.

audit: SELINUX_ERR op=security_compute_av reason=bounds scontext=system_u:system_r:container_t:s0:c259,c558 tcontext=unconfined_u:object_r:usr_t:s0 tclass=file 
perms=entrypoint

$ # ls -laZ /usr/local/src/wait-for-it/wait-for-it.sh
-rwxr-xr-x. 1 root root unconfined_u:object_r:usr_t:s0 3658 Aug 25 20:25 /usr/local/src/wait-for-it/wait-for-it.sh

$ cat /etc/systemd/system/etherpad.yml
...
etherpad:
  # Wait for MariaDB to be up.
  entrypoint: /wait-for-it.sh --strict --timeout=90 mariadb:3306 -- /entrypoint.sh
  command: bin/run.sh --root

  volumes:
    - /usr/local/src/wait-for-it/wait-for-it.sh:/wait-for-it.sh:ro

Please open a bugzilla for this. I see no reason for container-selinux to cause this issue.

Actually looking at this more closely it looks like you are bind mounting a file from /usr into the container, and then executing it?

If you chcon -t bin_t the executable, I would think the tool will work. Or if you mounted it in using :Z

Yes, I bind-mount using this line:

/usr/local/src/wait-for-it/wait-for-it.sh:/wait-for-it.sh:ro

I found it hard to decide where to put stuff with docker and SELinux, there's almost no documentation where files should be put such that SELinux allows access to them without having to fiddle with the policy. (See my comment on http://www.projectatomic.io/blog/2016/03/selinux-and-docker-part-2/)

I tried lowercase :ro,z today and it barked at me that relabeling is not permitted.

What I tried now:

$ chcon -t bin_t /usr/local/src/wait-for-it/wait-for-it.sh
$ ls -laZ /usr/local/src/wait-for-it/wait-for-it.sh
-rwxr-xr-x. 1 root root unconfined_u:object_r:bin_t:s0 3658 Aug 25 20:25 /usr/local/src/wait-for-it/wait-for-it.sh
# Restart container

-> panic: standard_init_linux.go:178: exec user process caused "permission denied" [recovered] and a note in the journal about audit: SELINUX_ERR op=security_compute_av reason=bounds ...

$ restorecon /usr/local/src/wait-for-it/wait-for-it.sh
$ ls -laZ /usr/local/src/wait-for-it/wait-for-it.sh
-rwxr-xr-x. 1 root root unconfined_u:object_r:usr_t:s0 3658 Aug 25 20:25 /usr/local/src/wait-for-it/wait-for-it.sh
# Changed mount to /usr/local/src/wait-for-it/wait-for-it.sh:/wait-for-it.sh:ro,Z
# Restart container

-> ERROR: for etherpad Cannot start service etherpad: SELinux relabeling of /usr/local/src/wait-for-it/wait-for-it.sh is not allowed: "Relabeling content in /usr is not allowed."

Is this a bug or am I doing something wrong, despite it being able to run under container-selinux-2.2-2.fc25.noarch.rpm.

Please open a Bugzilla or ping me on IRC to talk about this. But this should not block the package, since you would have this problem with out this update.

https://bugzilla.redhat.com/show_bug.cgi?id=1419288