Problem with binaries compiled in a container - SECCOMP/SELINUX issue?

I’m trying to compile OpenELEC, a minimal buildroot based distribution, under a container based on dock0/arch.

This works great, as long as I do the compilation in the container’s own filesystem. If I try to compile on my external disk which is connected with -v, I can get it compiled but some of the resulting binaries have issues loading shared libraries:

kodi.bin: error while loading shared libraries:

I think it’s probably related to SECCOMP or SELINUX, as googling shows similar problems from people who are trying to run binaries off storage mounted with the “noexec” option. In fact, I need to remount my external drive “exec” before compiling, which makes sense. However, something is corrupting the compiled binaries.

I’ve tried using --cap-add=all and every --security-opt, and the container is running --privileged. Any ideas how to resolve this so I can compile binaries on external storage?

Can you share a Dockerfile and as much information about your docker host as possible to describe how to reproduce the issue?

# docker info Containers: 3 Running: 3 Paused: 0 Stopped: 0 Images: 4 Server Version: library-import Storage Driver: overlay Backing Filesystem: extfs Logging Driver: json-file Cgroup Driver: cgroupfs Plugins: Volume: local Network: bridge null host Kernel Version: 4.6.0-rc5 Operating System: OpenELEC (community) - Version: devel-6ac2a6f OSType: linux Architecture: x86_64 CPUs: 2 Total Memory: 3.745 GiB Name: NUC ID: 7RDI:7UVJ:QFLL:22PN:26BC:C6BG:MDXQ:6NR4:64EG:VW3S:IHMR:HBVQ Docker Root Dir: /storage/.docker Debug mode (client): false Debug mode (server): false Registry: WARNING: No swap limit support

I’m just getting started with Docker, so I don’t have any Dockerfile to share that would help. To reproduce one can install a minimal arch with base-devel, clone to an external volume from the host and build:

`PROJECT=Generic ARCH=x86_64 make -j2 image"

Here’s the kernel config used:

Compiling on the filesystem inside the container works great, I can boot the resulting image just fine. When I build inside the container but on an external drive, I get the problem described above.

Hope that helps!

What are the docker commands that you are running to set up the environment to do the compilation to reproduce the problem?