dotcloud/docker — pull request #6452 by mheon (2014-06-16 15:15:54+00:00)
Title: Error if Docker daemon starts with BTRFS graph driver and SELinux enabled

At present, BTRFS and SELinux do not interact particularly well with regards to labelling. SELinux labels are assigned at the inode level, but BTRFS inodes may appear in multiple contexts - and, at present, there's no way for SELinux to distinguish between these.

Practical effect of this: On an SELinux enforcing machine with SELinux-aware Docker and the BTRFS graph driver active, core libraries - like libc.so.6 - will not be appropriately labelled so that containers can access them. Starting without SELinux container isolation should still be fine.

This is being worked on upstream, and hopefully should be fixed soon. In the meantime, this patch prevents the Docker daemon from starting in a BTRFS configuration with SELinux isolation enabled, which isn't a functional configuration at present.