Docker run throws error when user namespaces are used with SELinux on - docker

Question

I am trying to get Docker user namespaces to work with SELinux enabled on Centos 7.5. However, I get this error everytime:
docker run -itd --name temp -p 80:80 httpd
1a83588651b407e547881e15190b6d39692a7a2cf2df73dcaf4f37730ebdca65
docker: Error response from daemon: OCI runtime create failed: container_linux.go:348: starting container process caused "process_linux.go:301: running exec setns process for init caused \"exit status 40\"": unknown.
This does not happen if I turn of SELinux.
Here is my /etc/docker/daemon.json:
{
"userns-remap": "dockerspace",
"hosts": ["unix:///var/run/docker.sock", "tcp://0.0.0.0:2376"],
"tls": true,
"tlscacert": "/etc/pki/tls/certs/docker-ca.pem",
"tlscert": "/etc/pki/tls/certs/docker-cert.pem",
"tlskey": "/etc/pki/tls/private/docker-key.pem",
"tlsverify": true,
"selinux-enabled": true
}
uname -a output:
Linux atlantis.newtarget.net 3.10.0-862.9.1.el7.x86_64 #1 SMP Mon Jul 16 16:29:36 UTC 2018 x86_64 x86_64 x86_64 GNU/Linux
cat /proc/cmdline output:
BOOT_IMAGE=/vmlinuz-3.10.0-862.9.1.el7.x86_64 root=/dev/mapper/centos-root ro crashkernel=auto rd.lvm.lv=centos/root rd.lvm.lv=centos/swap rhgb quiet LANG=en_US.UTF-8 namespace.unpriv_enable=1 user_namespace.enable=1
Any help is greatly appreciated. Thanks.

Answer 1

You've got a bit more going on than I do when I was getting that error, but here goes!
Based on your cat /proc/cmdline output it looks like you have already done:
sudo grubby --args="namespace.unpriv_enable=1" --update-kernel=/boot/vmlinuz-$(uname -r)
You might need to restart for this to take effect (if you haven't already).
You also need to make sure the value in /proc/sys/user/max_user_namespaces is at least greater than 0:
echo 12345 > /proc/sys/user/max_user_namespaces
These settings along with configuring [/etc/subuid, /etc/subgid, /etc/docker/daemon.json] correctly it worked for me with selinux enabled. docker documentation on user namespacing, how to configure the above files (must be done manually for each on centos/rhel)