I combined the detailed instructions from the original blog post, and the more up to date instructions from the man page (using dnf instead of yum).# sudo dnf -y --releasever=24 --installroot=$HOME/fedora-24 --disablerepo='*' --enablerepo=fedora --enablerepo=updates install systemd passwd dnf fedora-release vim-minimal# sudo systemd-nspawn -D fedora-24Spawning container fedora-24 on /home/alan-sysop/fedora-24Press ^] three times within 1s to kill container.-bash-4.3# passwdChanging password for user root.New password:Retype new password:Result:passwd: Authentication token manipulation errorand an AVC popup, i.e. SELinux error.  It says passwd is not allowed to unlink (replace) /etc/passwd.  One of the suggestions from the Troubleshoot button is that I could assign the label passwd_file_t to /etc/passwd.What's wrong, how can I fix it?
systemd-nspawn OS container is unusable because I can't set the root password
fedora;selinux;container;systemd nspawn
For some reason, dnf didn't set the right SELinux label on /etc/passwd.  But it did set a label on /bin/passwd.  That mismatch is what causes the problem.  Further explanations welcomed :).$ ls -Z fedora-24/etc/passwdunconfined_u:object_r:etc_t:s0 fedora-24/etc/passwd$ ls -Z /etc/passwdsystem_u:object_r:passwd_file_t:s0 /etc/passwd$ ls -Z fedora-24/bin/passwdsystem_u:object_r:passwd_exec_t:s0 fedora-24/bin/passwd$ ls -Z /usr/bin/passwdsystem_u:object_r:passwd_exec_t:s0 /usr/bin/passwdAttempting to run restorecon -Rv / inside the container does nothing.  IIRC libselinux detects when it's run in a container, and will not do anything.  SolutionWe need to run from outside the container:restorecon -Rv fedora-24/It makes sure all the SELinux labels are reset.  (To the value expected by the container host, i.e. unlabelled).  Then we can set the root password successfully.