I recently switched from Docker to Podman and created a Kubernetes compliant pod definition yaml file.
The definition is loaded successful using rootless podman play kube command, then, declared Pod and container start but read access is denied when attempting to list content of hostPath bound volume within the container.

Loading the definition and dumping "front" container logs

$ podman play kube ./my-pod.yaml ; sleep 1 ; podman logs front
/var/www  # pwd
0 0       # echo `id -u` `id -g`
total 0   # ls -lha   
ls: cannot open '.': Permission denied

I believe the denial must have to do with SELinux restriction policy as file discretionary access control rights seem permissive enough on the host directory ...

$ pwd ; ls -lhaZ
drwxrwxr-x.  9 stph stph unconfined_u:object_r:user_home_t:s0 4.0K Apr 15 22:30 .
drwxrwxr-x.  4 stph stph unconfined_u:object_r:user_home_t:s0 4.0K Apr 15 22:30 ..
drwxr-xr-x.  5 stph stph unconfined_u:object_r:user_home_t:s0 4.0K Apr  3 14:11 ui

So, I naively applied same SELinux labels from host directory to pod, but it apparently and unsurprisingly did not resolved anything.

There may be something about private labeling according to podman play kube documentation:

Note: HostPath volume types created by play kube will be given an SELinux private label

Which I believe only means that hostpath volumes cannot be shared by multiple containers (I might be mistaken here).

Podman pod yaml definition file

apiVersion: v1
kind: Pod
  name: my-pod
  hostname: my-pod-host
  - name: projdir
      path: /home/stph/my-project
      type: Directory
      level: s0
      role: object_r
      type: user_home_t
      user: unconfined_u
  - name: front
    image: node:lts-alpine
    workingDir: /var/www
      - name: API_ENTRYPOINT
        value: "http://localhost:80/api"
      - containerPort: 5000
        hostPort: 5000
        protocol: TCP
    - name: projdir
      mountPath: /var/www
      subPath: ui
    command: ['/bin/sh', '-c', 'pwd ; echo `id -u` `id -g` ; ls -lha']

/etc/subuid mappings

cat /etc/subuid

Extract of podman inspect front output

  "Id": "c93a3d6...",
  "Created": "2020-04-15T19:01:14.034867742+02:00",
  "Path": "docker-entrypoint.sh",
  "Args": [
    "pwd ; echo `id -u` `id -g` ; ls -lha"
  "State": {
    "OciVersion": "1.0.1-dev",
    "Status": "exited",
  "Image": "f77abbe...",
  "ImageName": "node:lts-alpine",
  "Rootfs": "",
  "Pod": "26bd784...",
  "ResolvConfPath": "/run/user/1000/containers/overlay-containers/93c4707.../userdata/resolv.conf",
  "HostnamePath": "/run/user/1000/containers/overlay-containers/c93a3d.../userdata/hostname",
  "HostsPath": "/run/user/1000/containers/overlay-containers/93c4707.../userdata/hosts",
  "StaticDir": ".../containers/storage/overlay-containers/c93a3d.../userdata",
  "OCIConfigPath": ".../containers/storage/overlay-containers/c93a3d.../userdata/config.json",
  "OCIRuntime": "crun",
  "LogPath": ".../containers/storage/overlay-containers/c93a3d.../userdata/ctr.log",
  "LogTag": "",
  "ConmonPidFile": "/run/user/1000/containers/overlay-containers/c93a3d.../userdata/conmon.pid",
  "Name": "front",
  "RestartCount": 0,
  "Driver": "overlay",
  "MountLabel": "system_u:object_r:container_file_t:s0:c57,c80",
  "ProcessLabel": "system_u:system_r:container_t:s0:c57,c80",
  "Mounts": [
      "Type": "bind",
      "Name": "",
      "Source": "/home/stph/my-project",
      "Destination": "/var/www",
      "Driver": "",
      "Mode": "",
      "Options": [
      "RW": true,
      "Propagation": "rprivate"
  "Namespace": "",
  "IsInfra": false,
  "Config": {
    "Hostname": "ski-pod-host",
    "Domainname": "",
    "User": "",
    "AttachStdin": false,
    "AttachStdout": false,
    "AttachStderr": false,
    "Tty": false,
    "OpenStdin": false,
    "StdinOnce": false,
    "Env": [
    "Cmd": [
      "docker-entrypoint.sh", "/bin/sh", "-c", "pwd ; echo `id -u` `id -g` ; ls -lha"
    "Image": "node:lts-alpine",
    "Volumes": null,
    "WorkingDir": "/var/www",
    "Entrypoint": "",
    "StopSignal": 15
  "HostConfig": {
    "Binds": [
    "NetworkMode": "container:93c4707...",
    "RestartPolicy": {
      "Name": "",
      "MaximumRetryCount": 0
    "AutoRemove": false,
    "VolumeDriver": "",
    "VolumesFrom": null,
    "IpcMode": "container:93c4707...",
    "Cgroup": "",
    "Cgroups": "default",
    "Privileged": false,
    "ReadonlyRootfs": false,
    "SecurityOpt": [],

Related journalctl -a -r records do not show anything related to access denial nor unauthorized action.

Any suggestion on how to debug/resolve this situation? Thank you.

1 Answer 1


I had the same issue and I found this solution. Instead of trying to apply the same labels from the host, you just disable the labels:

      type: spc_t

The type: spc_t disable the SELinux's Label. It'd be the equivalent to run the command podman with the argument --security-opt label=disable. For example:

podman run -it --security-opt label=disable -v .:/foo alpine

I found the solution here: https://github.com/containers/libpod/pull/5307#issuecomment-590830455

I hope it helps.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .