{"action":"created","issue":{"url":"https://api.github.com/repos/TomasTomecek/sen/issues/61","labels_url":"https://api.github.com/repos/TomasTomecek/sen/issues/61/labels{/name}","comments_url":"https://api.github.com/repos/TomasTomecek/sen/issues/61/comments","events_url":"https://api.github.com/repos/TomasTomecek/sen/issues/61/events","html_url":"https://github.com/TomasTomecek/sen/pull/61","id":128847379,"number":61,"title":"README.md: We require --privileged","user":{"login":"cgwalters","id":244096,"avatar_url":"https://avatars.githubusercontent.com/u/244096?v=3","gravatar_id":"","url":"https://api.github.com/users/cgwalters","html_url":"https://github.com/cgwalters","followers_url":"https://api.github.com/users/cgwalters/followers","following_url":"https://api.github.com/users/cgwalters/following{/other_user}","gists_url":"https://api.github.com/users/cgwalters/gists{/gist_id}","starred_url":"https://api.github.com/users/cgwalters/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/cgwalters/subscriptions","organizations_url":"https://api.github.com/users/cgwalters/orgs","repos_url":"https://api.github.com/users/cgwalters/repos","events_url":"https://api.github.com/users/cgwalters/events{/privacy}","received_events_url":"https://api.github.com/users/cgwalters/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":2,"created_at":"2016-01-26T15:05:05Z","updated_at":"2016-01-26T15:35:13Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/TomasTomecek/sen/pulls/61","html_url":"https://github.com/TomasTomecek/sen/pull/61","diff_url":"https://github.com/TomasTomecek/sen/pull/61.diff","patch_url":"https://github.com/TomasTomecek/sen/pull/61.patch"},"body":"On an SELinux-enabled system at least.  Anyways, access to the docker\r\nsocket is equivalent to `--privileged`."},"comment":{"url":"https://api.github.com/repos/TomasTomecek/sen/issues/comments/175080543","html_url":"https://github.com/TomasTomecek/sen/pull/61#issuecomment-175080543","issue_url":"https://api.github.com/repos/TomasTomecek/sen/issues/61","id":175080543,"user":{"login":"cgwalters","id":244096,"avatar_url":"https://avatars.githubusercontent.com/u/244096?v=3","gravatar_id":"","url":"https://api.github.com/users/cgwalters","html_url":"https://github.com/cgwalters","followers_url":"https://api.github.com/users/cgwalters/followers","following_url":"https://api.github.com/users/cgwalters/following{/other_user}","gists_url":"https://api.github.com/users/cgwalters/gists{/gist_id}","starred_url":"https://api.github.com/users/cgwalters/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/cgwalters/subscriptions","organizations_url":"https://api.github.com/users/cgwalters/orgs","repos_url":"https://api.github.com/users/cgwalters/repos","events_url":"https://api.github.com/users/cgwalters/events{/privacy}","received_events_url":"https://api.github.com/users/cgwalters/received_events","type":"User","site_admin":false},"created_at":"2016-01-26T15:35:13Z","updated_at":"2016-01-26T15:35:13Z","body":"Bind mounts to the host on a Docker+SELinux system in practice require `--privileged` or labeling content. \r\n\r\nhttp://www.projectatomic.io/blog/2015/06/using-volumes-with-docker-can-cause-problems-with-selinux/\r\n\r\nIn this case I think `--privileged` is right even though technically no process in *this* container needs it, access to the docker socket is basically just `CAP_SYS_ADMIN` anyways."}}