I recently moved from Fedora to openSUSE and tried to build a project that worked previously. Containers started with docker run can access their files, but the same paths fail when mounted through Docker Compose. The errors include Python being unable to open /app/app.py, npm receiving EACCES while reading /web/package.json, and MongoDB being unable to access or chown /data/db. The files and host-side permissions look correct. My Compose mounts include ./ .mounted/mongo:/data/db, ./web:/web, ./apis/auth-dev:/app, and ./config:/app/config. Switching SELinux to permissive mode with sudo setenforce 0 makes the stack work, but I would prefer a proper fix.
2 Answers
This points to SELinux labeling rather than ordinary Unix permissions. Bind-mounted files need an SELinux context that allows the container to access them. Add the appropriate label suffix to the Compose mounts, usually :Z for a private label or :z when the directory is shared by multiple containers. For example: ./web:/web:Z, ./apis/auth-dev:/app:Z, ./config:/app/config:Z, and ./.mounted/mongo:/data/db:Z. Recreate the containers afterward so the labels are applied. You can verify the contexts with ls -Z. Avoid leaving SELinux permissive; that only bypasses the policy instead of fixing the mount labels.
The mount definitions are the key detail here. Container processes may run as a different UID, but changing host ownership alone will not overcome an SELinux denial. Check the audit log while starting the stack with ausearch -m avc -ts recent or journalctl for AVC messages. If they confirm SELinux, use :Z or :z on each bind mount, then run docker compose down and recreate the services. Also make sure the host directories are not on a filesystem or location with additional restrictions.
That matches the behavior I saw: setenforce 0 removes the errors, so SELinux is enforcing a policy against the bind mounts. Applying :Z to the mounts is the safer solution, assuming those directories are not intended to be shared between unrelated containers.