privileged containers running under Docker cannot write to their rootfs

[bcressey]

Image I'm using:
aws-dev

What I expected to happen:
Running a privileged container under docker should add the "context=" option so that the rootfs is writable.

What actually happened:
The context option not added and an AVC denial is logged when attempting to write to the rootfs.

How to reproduce the problem:

$ docker run -it --privileged amazonlinux:2 bash
$ touch test
touch: cannot touch 'test': Permission denied

[samuelkarp]

When a container is --privileged, Docker injects the equivalent of --security-opt label:disable. This has the effect of short-circuiting the logic for finding the appropriate mount label, causing the rootfs to be mounted without the appropriate label.

We can add a patch removing the injection of --security-opt label:disable (and thus making --privileged containers have both process labeling and mount labeling) or add a patch that ensures we have a default mount label regardless of whether label:disable is used. My inclination is toward the first patch; customers who want fully-privileged containers on Bottlerocket can add label:type:super_t or who want to disable all labeling can add label:disable.