Stay organized with collections
Save and categorize content based on your preferences.
This page shows you how to secure your containers by enabling SELinux. SELinux
is supported for Red Hat Enterprise Linux (RHEL). If your host machines are
running RHEL and you want to enable SELinux for your cluster, you must enable
SELinux in all of your host machines. Starting with Google Distributed Cloud release
1.9.0, you can enable or disable SELinux before or after cluster creation or
cluster upgrades. When SELinux is enabled on the host, it is enabled for the
container runtime.
Check if SELinux is enabled
SELinux is enabled on RHEL by default.
To verify, run:
getenforce
The command returns either Enforcing, Permissive, or Disabled. If the
command returns Enforcing, then you can proceed with upgrading or creating
your clusters.
Enable SELinux
If the getenforce command returns Permissive, you can switch to Enforcing
mode using the setenforce command. Toggling between Permissive and
Enforcing mode using setenforce doesn't require a system reboot. However, if
you want the changes to be persistent across reboots, you must update the
/etc/selinux/config file.
To switch to Enforcing mode, run:
sudosetenforce1# temporary
sudosed-i's/SELINUX=permissive/SELINUX=enforcing/g'/etc/selinux/config# persistent - after reboot
If SELinux is Disabled, to enable it, we recommend to first enable it in
Permissive mode first and reboot the system to verify that the system boots
successfully. If there are no SELinux errors, then you can safely switch SELinux
to Enforcing mode.
[[["Easy to understand","easyToUnderstand","thumb-up"],["Solved my problem","solvedMyProblem","thumb-up"],["Other","otherUp","thumb-up"]],[["Hard to understand","hardToUnderstand","thumb-down"],["Incorrect information or sample code","incorrectInformationOrSampleCode","thumb-down"],["Missing the information/samples I need","missingTheInformationSamplesINeed","thumb-down"],["Other","otherDown","thumb-down"]],["Last updated 2025-08-25 UTC."],[],[],null,["# Secure your containers using SELinux\n\nThis page shows you how to secure your containers by enabling SELinux. SELinux\nis supported for Red Hat Enterprise Linux (RHEL). If your host machines are\nrunning RHEL and you want to enable SELinux for your cluster, you must enable\nSELinux in all of your host machines. Starting with Google Distributed Cloud release\n1.9.0, you can enable or disable SELinux before or after cluster creation or\ncluster upgrades. When SELinux is enabled on the host, it is enabled for the\ncontainer runtime.\n\nCheck if SELinux is enabled\n---------------------------\n\nSELinux is enabled on RHEL by default.\n\n- To verify, run:\n\n getenforce\n\nThe command returns either `Enforcing`, `Permissive`, or `Disabled`. If the\ncommand returns `Enforcing`, then you can proceed with upgrading or creating\nyour clusters.\n\nEnable SELinux\n--------------\n\nIf the `getenforce` command returns `Permissive`, you can switch to `Enforcing`\nmode using the `setenforce` command. Toggling between `Permissive` and\n`Enforcing` mode using `setenforce` doesn't require a system reboot. However, if\nyou want the changes to be persistent across reboots, you must update the\n`/etc/selinux/config` file.\n\n- To switch to `Enforcing` mode, run:\n\n sudo setenforce 1 # temporary\n sudo sed -i 's/SELINUX=permissive/SELINUX=enforcing/g' /etc/selinux/config # persistent - after reboot\n\nIf SELinux is `Disabled`, to enable it, we recommend to first enable it in\n`Permissive` mode first and reboot the system to verify that the system boots\nsuccessfully. If there are no SELinux errors, then you can safely switch SELinux\nto `Enforcing` mode.\n\n1. **Optional** : Enable SELinux in `Permissive` mode:\n\n sudo sed -i 's/SELINUX=disabled/SELINUX=permissive/g' /etc/selinux/config\n sudo reboot\n\n2. If the system reboots successfully with no SELinux errors, then you can\n enable `Enforcing` mode:\n\n sudo sed -i 's/SELINUX=disabled/SELINUX=enforcing/g' /etc/selinux/config\n sudo reboot\n\nOnce SELinux is enabled in `Enforcing` mode, SELinux is enabled for all\nprocesses on the host, including the container runtime."]]
