gscrivano added a new comment to an issue you are following:
``
one important change in the atomic system containers is that now an atomic system
container uses the SELinux policy from the host. Every file in the container gets the
same label it would have if installed on the host (e.g. /usr/bin/foo in the container has
the same SELinux label as /usr/bin/foo on the host).
Advantages:
1) We can run containerized system services without losing the possibility of having
different SELinux contexts (e.g. the docker system container will run as
system_u:system_r:container_runtime_t:s0)
2) We can finally fully deduplicate files on AH with the rest of the system as there is no
mismatch in the xattrs.
``
To reply, visit the link below or just reply to this email
https://pagure.io/atomic-wg/issue/445