Drop Release label in favor of OSBS release_bump plugin.

OSBS can automatically bump the release number, for that
we just need to drop the label from the Dockerfile

See https://pagure.io/ContainerSIG/container-sig/issue/1

Signed-off-by: Clement Verna <cverna@tutanota.com>

Dockerfile

@@ -1,10 +1,9 @@
-FROM registry.fedoraproject.org/fedora:26
+FROM registry.fedoraproject.org/fedora:rawhide
 
-ENV VERSION=0 RELEASE=9 ARCH=x86_64
+ENV VERSION=0 ARCH=x86_64
 LABEL com.redhat.component="docker" \
-      name="$FGC/docker" \
+      name="docker" \
       version="$VERSION" \
-      release="$RELEASE.$DISTTAG" \
       architecture="$ARCH" \
       usage="atomic install --system --system-package=no docker && systemctl start docker" \
       summary="The docker daemon as a system container." \
@@ -13,8 +12,7 @@ LABEL com.redhat.component="docker" \
 
 RUN dnf install --setopt=tsflags=nodocs -y docker container-storage-setup container-selinux cloud-utils-growpart python-docker-py docker-novolume-plugin lvm2 iptables procps-ng xz oci-register-machine \
     && rpm -V docker container-storage-setup container-selinux cloud-utils-growpart python-docker-py docker-novolume-plugin lvm2 iptables procps-ng xz oci-register-machine \
-    && mkdir -p /usr/lib/modules /exports/hostfs/etc/docker \
-    && dnf clean all
+    && mkdir -p /usr/lib/modules && dnf clean all
 
 RUN ln -s /usr/libexec/docker/docker-runc-current /usr/bin/docker-runc
 
@@ -26,8 +24,6 @@ COPY set_mounts.sh /
 COPY config.json.template service.template tmpfiles.template /exports/
 COPY daemon.json /exports/hostfs/etc/docker/container-daemon.json
 # https://github.com/rhatdan/oci-umount/issues/2
-# Copy config if available
-RUN (test -e /etc/oci-umount.conf && cp /etc/oci-umount.conf /exports/hostfs/etc) || true
-
+RUN cp /etc/oci-umount.conf /exports/hostfs/etc
 
 CMD ["/usr/bin/init.sh"]

config.json.template

@@ -5,7 +5,6 @@
 	"arch": "amd64"
     },
     "process": {
-	"selinuxLabel": "system_u:system_r:container_runtime_t:s0",
 	"terminal": false,
 	"user": {
 	    "uid": 0,
@@ -295,6 +294,17 @@
 		"mode=755"
             ]
 	},
+	{
+	    "type": "bind",
+	    "source": "/usr/share/rhel",
+	    "destination": "/usr/share/rhel",
+	    "options": [
+		"rprivate",
+		"rbind",
+		"ro",
+		"mode=755"
+	    ]
+	},
 	{
 	    "type": "bind",
 	    "source": "${RUN_DIRECTORY}",
@@ -370,7 +380,7 @@
     ],
     "hooks": {},
     "linux": {
-	"rootfsPropagation": "rslave",
+	"rootfsPropagation": "private",
 	"resources": {
 	    "devices": [
 		{
@@ -383,6 +393,7 @@
 	    {
 		"type": "mount"
 	    }
-	]
+	],
+	"selinuxProcessLabel": "system_u:system_r:container_runtime_t:s0"
     }
 }

daemon.json

@@ -1,4 +1,6 @@
+
 {
+    "authorization-plugins": ["rhel-push-plugin"],
     "default-runtime": "oci",
     "containerd": "/run/containerd.sock",
     "userland-proxy-path": "/usr/libexec/docker/docker-proxy-current",

init.sh

@@ -1,10 +1,5 @@
 #!/bin/bash
 
-# Ensure that new process maintain this SELinux label
-PID=$$
-LABEL=`tr -d '\000' < /proc/$PID/attr/current`
-printf %s $LABEL > /proc/self/attr/exec
-
 source /run/docker-bash-env
 
 # set storage first
@@ -27,7 +22,7 @@ do
       sleep 0.1
 done
 
-# Run all the installed plugins
+# Run all the installed containers
 mkdir -p /run/docker/plugins/
 ls -1 /usr/libexec/docker/*plugin |  \
 while read i;

service.template

@@ -6,7 +6,6 @@ After=network.target
 EnvironmentFile=-/etc/sysconfig/docker-storage
 EnvironmentFile=-/etc/sysconfig/docker-network
 Environment=GOTRACEBACK=crash
-SELinuxContext=system_u:system_r:container_runtime_t:s0
 ExecStartPre=/bin/sh $DESTDIR/rootfs/set_mounts.sh
 ExecStartPre=/bin/bash -c 'export -p > /run/docker-bash-env'
 ExecStart=$EXEC_START