<p>I have two k8s cluster, one using docker and another using containerd directly, both with selinux enabled.
but I found selinux not actually working on the containerd one, although this two cluster have the same version of containerd and runc. </p>

<p>did i miss some setting with containerd?</p>

<p>docker: file label is <strong>container_file_t</strong>, and process runs as <strong>container_t</strong>, selinux works fine</p>

<pre><code>K8s version: 1.17
Docker version: 19.03.6
Containerd version: 1.2.10
selinux enable by adding ["selinux-enabled": true] to /etc/docker/daemon.json

// create pod using tomcat official image then check the process and file label
# kubectl exec tomcat -it -- ps -eZ
LABEL                             PID TTY          TIME CMD
system_u:system_r:container_t:s0:c655,c743          1 ?        00:00:00 java

# ls -Z /usr/local/openjdk-8/bin/java
system_u:object_r:container_file_t:s0:c655,c743 /usr/local/openjdk-8/bin/java
</code></pre>

<p>containerd: file label is <strong>container_var_lib_t</strong>, and process runs as <strong>spc_t</strong>, selinux makes no sense</p>

<pre><code>K8s version: 1.15
Containerd version: 1.2.10
selinux enable by setting [enable_selinux = true] in /etc/containerd/config.toml

// create pod using tomcat official image then check the process and file label
# kubectl exec tomcat -it -- ps -eZ
LABEL                             PID TTY          TIME CMD
system_u:system_r:spc_t:s0          1 ?        00:00:00 java

# ls -Z /usr/local/openjdk-8/bin/java
system_u:object_r:container_var_lib_t:s0 /usr/local/openjdk-8/bin/java

// seems run as spc_t is correct
# sesearch -T -t container_var_lib_t | grep spc_t
   type_transition container_runtime_t container_var_lib_t : process spc_t;
</code></pre>

Cyron
<p>From this <a href="https://github.com/containerd/cri/issues/1195" rel="nofollow noreferrer">issue</a> we can read: </p>

<blockquote>
  <p>Containerd includes minimal support for SELinux. More accurately, it
  contains support to run ON systems using SELinux, but it does not make
  use of SELinux to improve container security.</p>
  
  <p>All containers run with the 
  <code>system_u:system_r:container_runtime_t:s0</code>  label, but no further
  segmentation is made</p>
</blockquote>

<p>There is no full support for what you are doing using Containerd. Your approach is correct but the problem is lack of support to this functionality. </p>
