Files
container/Sources/Services/ContainerSandboxService
J LoganandGitHub adb3c44754 Don't enable selinux LSM on boot. (#1166)
- Closes #1150.
- The problem seems to be that the selinux label attribute enforcement
doesn't play well with overlayfs.
- Solution is to set the `lsm` boot line argument. The new value
corresponds to what one would see in a Lima VM with Colima. The Kata
kernel we use doesn't provide any of those modules, so now if you run
`dmesg | grep -i lsm` in a container you will just see: `LSM:
initializing lsm=capability`
2026-02-05 20:19:13 -08:00
..