build: add CONTAINER_MOUNT_OPTS to toolchain container runs#779
Merged
Conversation
Introduce an overridable CONTAINER_MOUNT_OPTS variable (default empty)
and inject it before the workspace bind mount in every toolchain
container invocation (all/build/build-cores/build-core and the
runtime-check cleanup).
On SELinux-enforcing hosts (e.g. Fedora Toolbox) the toolchain container
can't read the bind-mounted workspace, failing with "Permission denied"
on the makefile. Setting CONTAINER_MOUNT_OPTS="--security-opt
label=disable" lets the container access the mount without relabeling
the tree (":z" relabeling doesn't work through rootless/flatpak-spawn
setups).
Default-empty keeps existing behavior unchanged on non-SELinux hosts.
Author
|
This is just a small workaround to an issue I was running into. I run Fedora Silverblue and do all my development in a Toolbox container. Toolbox does not like Has no effect on builds that don't specify CONTAINER_MOUNT_OPTS manually. Successfully built via: |
Member
|
Looks good to me. I've restarted the failed builds, looks like a temporary issue upstream. |
frysee
approved these changes
Jul 16, 2026
Author
|
Looks like the CI failure was a transient issue 👍 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Introduce an overridable CONTAINER_MOUNT_OPTS variable (default empty) and inject it before the workspace bind mount in every toolchain container invocation (all/build/build-cores/build-core and the runtime-check cleanup).
On SELinux-enforcing hosts (e.g. Fedora Toolbox) the toolchain container can't read the bind-mounted workspace, failing with "Permission denied" on the makefile. Setting CONTAINER_MOUNT_OPTS="--security-opt label=disable" lets the container access the mount without relabeling the tree (":z" relabeling doesn't work through rootless/flatpak-spawn setups).
Default-empty keeps existing behavior unchanged on non-SELinux hosts.