This is an automated email from the ASF dual-hosted git repository.
hubcio pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/iggy.git
The following commit(s) were added to refs/heads/master by this push:
new 17473ded1 fix(connectors): disable SELinux label checks for WireMock
test containers (#4265)
17473ded1 is described below
commit 17473ded1719f23cef50c4f82c60790679e9b626
Author: Daniil Novikov <[email protected]>
AuthorDate: Mon Sep 28 23:20:11 2026 +0200
fix(connectors): disable SELinux label checks for WireMock test containers
(#4265)
---
core/integration/tests/connectors/fixtures/http/container.rs | 6 ++++++
core/integration/tests/connectors/fixtures/wiremock.rs | 6 ++++++
2 files changed, 12 insertions(+)
diff --git a/core/integration/tests/connectors/fixtures/http/container.rs
b/core/integration/tests/connectors/fixtures/http/container.rs
index 81dcca2c9..dda1ec489 100644
--- a/core/integration/tests/connectors/fixtures/http/container.rs
+++ b/core/integration/tests/connectors/fixtures/http/container.rs
@@ -85,6 +85,12 @@ impl HttpSinkWireMockContainer {
.to_string(),
"/home/wiremock/mappings",
))
+ // Bind-mounted fixture files keep the host's SELinux label, which
the
+ // container's confined context can't read on SELinux-enforcing
hosts
+ // (denied even though the host user has full Unix permissions).
+ // `label=disable` skips that check instead of requiring every
+ // contributor to relabel the fixture directory themselves.
+ .with_security_opt("label=disable")
.with_container_name(fixtures::unique_container_name("wiremock-http"))
.start()
.await
diff --git a/core/integration/tests/connectors/fixtures/wiremock.rs
b/core/integration/tests/connectors/fixtures/wiremock.rs
index 65f4974ec..64818fc36 100644
--- a/core/integration/tests/connectors/fixtures/wiremock.rs
+++ b/core/integration/tests/connectors/fixtures/wiremock.rs
@@ -61,6 +61,12 @@ impl WireMockContainer {
.to_string(),
"/home/wiremock/__files",
))
+ // Bind-mounted fixture files keep the host's SELinux label, which
the
+ // container's confined context can't read on SELinux-enforcing
hosts
+ // (denied even though the host user has full Unix permissions).
+ // `label=disable` skips that check instead of requiring every
+ // contributor to relabel the fixture directory themselves.
+ .with_security_opt("label=disable")
.with_container_name(fixtures::unique_container_name("wiremock"))
.start()
.await
