I've created a NFS volume with

docker volume create --driver local --opt type=nfs --opt o=addr=preisschild-server-2.lan,rw --opt device=:/mnt/tank/MariaDB MariaDBData

which seems to work, but when I use the volume on a docker container:

docker run --name MariaDB -v MariaDBData:/var/lib/mysql -e MYSQL_ROOT_PASSWORD=topsecretpassword --network bridged -p 3306:3306 -d mariadb:latest

I get /usr/bin/docker-current: Error response from daemon: SELinux relabeling of /var/lib/docker/volumes/MariaDBDataNFS/_data is not allowed: "operation not supported" as output. I've already tried settings permissive, but that didn't work.

Additional Information: OS: CentOS7 Docker Version: 1.13.1

  • You probably have to use virt_use_nfs boolean (setsebool virt_use_nfs 1). If it works, I can write an answer.
    – sebasth
    Nov 17, 2018 at 15:49
  • @sebasth Thanks for trying to help! But unfortunately that doesn't work. It still shows "SELinux relabeling of /var/lib/docker/volumes/MariaDBData/_data is not allowed: "operation not supported"." Nov 17, 2018 at 15:55
  • Also when I try to mount it directly without a external volume with docker run --name MariaDB --volume-driver=nfs -v preisschild-server-2.lan/mnt/tank/MariaDB:/var/lib/mysql ... It gives me /usr/bin/docker-current: Error response from daemon: create preisschild-server-2.lan/mnt/tank/MariaDB: create preisschild-server-2.lan/mnt/tank/MariaDB: Error looking up volume plugin nfs: legacy plugin: plugin not found. Nov 17, 2018 at 15:59
  • Are there relevant AVC messages in audit log (/var/log/audit/audit.log)?
    – sebasth
    Nov 17, 2018 at 15:59
  • @sebasth The only line I get when i do docker-run is type=VIRT_CONTROL msg=audit(1542470519.281:11343): pid=1755 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:container_runtime_t:s0 msg='op=create vm-pid=? user=root exe=? ctr_id_short=? reason=api vm=? auid=0 hostname=? exe="/usr/bin/dockerd-current" hostname=? addr=? terminal=? res=success'' Nov 17, 2018 at 16:03

2 Answers 2



docker run --name MariaDB -v MariaDBData:/var/lib/mysql:z -e MYSQL_ROOT_PASSWORD=topsecretpassword --network bridged -p 3306:3306 -d mariadb:latest


docker run --name MariaDB -v MariaDBData:/var/lib/mysql:Z -e MYSQL_ROOT_PASSWORD=topsecretpassword --network bridged -p 3306:3306 -d mariadb:latest


Disable Selinux before running the command


As you're using docker-current I assume that you're on RHEL(7) and SELinux is configured (either Enforcing or Permissive).

I think you've been hit by this bug: https://bugzilla.redhat.com/show_bug.cgi?id=1492113#c0

At the bottom of the linked comment you can find the workaround, which I'm happily pasting also here. Use the nocopy option instead of z or Z:

docker run --name MariaDB -v MariaDBData:/var/lib/mysql:nocopy -e MYSQL_ROOT_PASSWORD=topsecretpassword --network bridged -p 3306:3306 -d mariadb:latest

See this great github comment to get a grasp of what nocopy is about. https://github.com/docker/docker.github.io/issues/2992#issuecomment-299596714

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .