title: Docker and PaX host
body: <p>I've spent the last few days messing with trying to get docker containers to run correctly on Gentoo Hardened.</p>
  
  <p>The first problem that took me days to discover was motivated by my own paranoia: The partition I placed the Docker root into was mounted with nosuid and noexec. As a result, devicemapper driver worked on it, since it creates numerous loop devices to do its thing, but overlay driver did not, because it inherited the noexec flag from the top, so no executables within containers would run. I'll just leave this piece of knowledge for someone to discover here...</p>
  
  <p>With that out of the way, however, I tripped over another problem: PaX flags.</p>
  
  <p>PaX mandates that executables that require to create new memory pages containing code be marked with either special ELF headers or extended filesystem attributes, preferably both, because the recommended setting for Gentoo is to use the extended attributes and ignore the ELF headers. Executables that don't comply get killed the moment they try.</p>
  
  <p>Unfortunately the list of programs that just have to try includes nodejs, python, and pretty much every other modern interpreter, not to mention mongodb. There are probably other problem executables, but these are the primary culprits, and also the thing you frequently want to see in containers.</p>
  
  <p>Even more unfortunately, even though docker images are supposed to be capable of containing files marked by extended attributes, none of the official images for common software which requires such flags -- mongodb and nodejs in particular -- appear to have those.</p>
  
  <p>For the moment, I've been hacking around the problem by locating the actual file on disk and setting its xattr from outside the container. This is obviously a royally bad idea.</p>
  
  <p>What is the proper way to solve this problem, and for that matter, is there a particular reason nobody else seems to have it, as copious googling appears to indicate? Is there, perhaps, another kernel option I missed, (I tend to do that a lot) or a specific recommended way to set them so it remains secure and actually works? Beside turning PaX off, that is.</p>