{"action":"created","issue":{"url":"https://api.github.com/repos/docker/docker/issues/18005","repository_url":"https://api.github.com/repos/docker/docker","labels_url":"https://api.github.com/repos/docker/docker/issues/18005/labels{/name}","comments_url":"https://api.github.com/repos/docker/docker/issues/18005/comments","events_url":"https://api.github.com/repos/docker/docker/issues/18005/events","html_url":"https://github.com/docker/docker/issues/18005","id":117085605,"number":18005,"title":"Volume plugins fail when selinux is enabled","user":{"login":"jfindley","id":7963257,"avatar_url":"https://avatars.githubusercontent.com/u/7963257?v=3","gravatar_id":"","url":"https://api.github.com/users/jfindley","html_url":"https://github.com/jfindley","followers_url":"https://api.github.com/users/jfindley/followers","following_url":"https://api.github.com/users/jfindley/following{/other_user}","gists_url":"https://api.github.com/users/jfindley/gists{/gist_id}","starred_url":"https://api.github.com/users/jfindley/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jfindley/subscriptions","organizations_url":"https://api.github.com/users/jfindley/orgs","repos_url":"https://api.github.com/users/jfindley/repos","events_url":"https://api.github.com/users/jfindley/events{/privacy}","received_events_url":"https://api.github.com/users/jfindley/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/docker/docker/labels/area/security/selinux","name":"area/security/selinux","color":"fbca04"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":18,"created_at":"2015-11-16T09:45:20Z","updated_at":"2016-02-27T19:52:55Z","closed_at":null,"body":"When a docker volume plugin is use, and docker daemon is running with --selinux-enabled, attempts to use a volume plugin will result in a confusing error message: ```Error response from daemon: no such file or directory```.  This appears to be because of selinux support, running the container with --security-opt label:disable fixes this.\r\n\r\nLooking deeper into this, I believe this is related to [syscall_linux:138](https://github.com/docker/docker/blob/729c9a97822ebee2c978a322d37060454af6bc66/vendor/src/github.com/syndtr/gocapability/capability/syscall_linux.go#L138) where the daemon tries to set an selinux context on the volume path.  However, when using a volume plugin, path will evaluate to an empty string, hence the error message.\r\n\r\nStrace output demonstrating this:\r\n```\r\n[pid  7442] read(61, \"HTTP/1.1 200 OK\\r\\nContent-Type: appplication/vnd.docker.plugins.v1+json\\r\\nDate: Mon, 16 Nov 2015 09:16:08 GMT\\r\\nContent-Length: 3\\r\\n\\r\\n{}\\n\", 4096) = 133\r\n[pid  7442] read(61, 0xc2085ae000, 4096) = -1 EAGAIN (Resource temporarily unavailable)\r\n[pid  7442] write(61, \"POST /VolumeDriver.Path HTTP/1.1\\r\\nHost: /run/docker/plugins/rexray.sock\\r\\nUser-Agent: Go 1.1 package http\\r\\nContent-Length: 27\\r\\nAccept: application/vnd.docker.plugins.v1+json\\r\\n\\r\\n{\\\"Name\\\":\\\"rexray-test-vol\\\"}\\n\", 203) = 203\r\n[pid  7442] epoll_wait(4, {}, 128, 0)   = 0\r\n[pid  7149] <... sched_yield resumed> ) = 0\r\n[pid  7442] epoll_wait(4,  <unfinished ...>\r\n[pid  7421] <... read resumed> \"time=\\\"2015-11-16T09:16:08Z\\\" level=info msg=\\\"getting path to volume\\\" driverName=docker volumeID= volumeName=rexray-test-vol \\n\", 32768) = 124\r\n[pid  7442] <... epoll_wait resumed> {{EPOLLOUT, {u32=2667585840, u64=140031486337328}}}, 128, -1) = 1\r\n[pid  7421] read(39,  <unfinished ...>\r\n[pid  7442] epoll_wait(4,  <unfinished ...>\r\n[pid  7149] select(0, NULL, NULL, NULL, {0, 20}) = 0 (Timeout)\r\n[pid  7149] select(0, NULL, NULL, NULL, {0, 20} <unfinished ...>\r\n[pid  7211] write(11, \"{\\\"log\\\":\\\"time=\\\\\\\"2015-11-16T09:16:08Z\\\\\\\" level=info msg=\\\\\\\"getting path to volume\\\\\\\" driverName=docker volumeID= volumeName=rexray-test-vol \\\\n\\\",\\\"stream\\\":\\\"stdout\\\",\\\"time\\\":\\\"2015-11-16T09:16:08.437652525Z\\\"}\\n\", 198) = 198\r\n[pid  7149] <... select resumed> )      = 0 (Timeout)\r\n[pid  7149] clock[pid  7149] clock[pid  7149] clock[pid  7149] clock[pid  d  7149] select(0, NULL, NULL, NULL, {0, 20} <unfinished ...>\r\n[pid  7211] epoll_wait(4, {}, 128, 0)   = 0\r\n[pid  7149] <... select resumed> )      = 0 (Timeout)\r\n[pid  7442] <... epoll_wait resumed> {{EPOLLIN|EPOLLOUT, {u32=2667585840, u64=140031486337328}}}, 128, -1) = 1\r\n[pid  7149] sched_yield( <unfinished ...>\r\n[pid  7442] read(61, \"HTTP/1.1 200 OK\\r\\nContent-Type: appplication/vnd.docker.plugins.v1+json\\r\\nDate: Mon, 16 Nov 2015 09:16:08 GMT\\r\\nContent-Length: 19\\r\\n\\r\\n{\\\"Mountpoint\\\": \\\"\\\"}\\n\", 4096) = 150\r\n[pid  7442] lstat(\"\", 0xc2085a6090)     = -1 ENOENT (No such file or directory)\r\n[pid  7442] lsetxattr(\"\", \"security.selinux\", \"system_u:object_r:svirt_sandbox_file_t:s0\", 41, 0) = -1 ENOENT (No such file or directory)\r\n[pid  7442] write(2, \"time=\\\"2015-11-16T09:16:08.755380971Z\\\" level=error msg=\\\"Handler for POST /containers/create returned error: no such file or directory\\\" \\n\", 135) = 135\r\n[pid  7149] <... sched_yield resumed> ) = 0\r\n[pid  7442] write(2, \"time=\\\"2015-11-16T09:16:08.757670389Z\\\" level=error msg=\\\"HTTP Error\\\" err=\\\"no such file or directory\\\" statusCode=404 \\n\", 115 <unfinished ...>\r\n```"},"comment":{"url":"https://api.github.com/repos/docker/docker/issues/comments/189714058","html_url":"https://github.com/docker/docker/issues/18005#issuecomment-189714058","issue_url":"https://api.github.com/repos/docker/docker/issues/18005","id":189714058,"user":{"login":"clintonskitson","id":1395761,"avatar_url":"https://avatars.githubusercontent.com/u/1395761?v=3","gravatar_id":"","url":"https://api.github.com/users/clintonskitson","html_url":"https://github.com/clintonskitson","followers_url":"https://api.github.com/users/clintonskitson/followers","following_url":"https://api.github.com/users/clintonskitson/following{/other_user}","gists_url":"https://api.github.com/users/clintonskitson/gists{/gist_id}","starred_url":"https://api.github.com/users/clintonskitson/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/clintonskitson/subscriptions","organizations_url":"https://api.github.com/users/clintonskitson/orgs","repos_url":"https://api.github.com/users/clintonskitson/repos","events_url":"https://api.github.com/users/clintonskitson/events{/privacy}","received_events_url":"https://api.github.com/users/clintonskitson/received_events","type":"User","site_admin":false},"created_at":"2016-02-27T19:52:55Z","updated_at":"2016-02-27T19:52:55Z","body":"@rhatdan I was able to verify that with CoreOS, specifying the parameter you mentioned prior does make it work correctly.\r\n\r\n`docker run -ti --security-opt=label:disable --volume-driver=rexray -v testing221:/tst busybox`"}}