kopia lustrzana https://github.com/OpenDroneMap/WebODM
2317916f93
docker-compose.yml: :z on volume mounts relabels the directory to enable access for all docker container :Z on volume mounts relabels the directory to enable access for this specific docker container Some background: https://www.projectatomic.io/blog/2015/06/using-volumes-with-docker-can-cause-problems-with-selinux/ https://docs.docker.com/release-notes/docker-compose/ (-> Syntax introduced in v1.4.0 from 2015-08-04) Since these volumes are designed only for use by webodm a relabeling to allow docker containers to have access seems resonable. webodm/settings.py: The change in webodm/settings.py is necessary, because else the webapp will create big upload files in /tmp and move them to the final destination afterwards. Which means they will have container specific MCS context selinux labels applied to them. If the tmp files are created under MEDIA_ROOT, which has the :z labels applied to it, the files will get a label that is accessible from all docker containers. Some background: https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/selinux_users_and_administrators_guide/sect-security-enhanced_linux-working_with_selinux-selinux_contexts_labeling_files |
||
|---|---|---|
| .. | ||
| __init__.py | ||
| settings.py | ||
| urls.py | ||
| wsgi.py | ||