SELinux MCS challenges with GitLab Runners

Table of Contents Introduction The MCS problem The test script GitLab&rsquo;s official suggestion and why it falls short How GNOME currently handles this Exploring libkrun Firecracker and the custom executor path What comes next Introduction GNOME&rsquo;s GitLab runners use Podman as the container runtime with SELinux in Enforcing mode on Fedora. The GitLab Runner Docker/Podman executor spawns…