Let me just assure everyone that it's not broken by design. Many of us use SElinux to harden systems and services on a regular. But that said, it's not user fr

Let me just assure everyone that it's not broken by design. Many of us use SElinux to harden systems and services on a regular. But that said, it's not user friendly either. It's definitely a skill I list on my CV. Either learn it and feel better about it, or set it to permissive mode and live with that. I agree with mindwok, SElinux defaults from distro + containers work just fine. Rarely any policy issues, and you get the isolation of containers on top of that. So I wouldn't set SElinux into permissive mode just to use containers, I'd use both. Which I currently am doing on my container host at home for example. Edit: Today's press[1] have an excellent example of a vulnerability that should be stopped by SElinux default policies. Look at NetworkManager/dispatcher.d as an example, semange fcontext -l | grep 'NetworkManager/dispatcher' and you'll see it only has the exec context on that one directory. So even if you could exploit a directory traversal and place malicious scripts in other places, it would not be allowed to execute them. 1. https://arstechnica.com/information-technology/2022/04/microsoft-finds-linux-desktop-flaw-that-gives-root-to-untrusted-users/ https://arstechnica.com/information-technology/2022/04/micro...