From 781c39d80d7ecde26b6d7405abed2d57406c9f3b Mon Sep 17 00:00:00 2001 From: Iriome Date: Sun, 13 Sep 2026 00:31:36 +0100 Subject: [PATCH] Handle systempaths=unconfined security option Signed-off-by: Iriome --- .gitignore | 1 + docker/types/containers.py | 11 ++++++++++- tests/unit/api_test.py | 9 +++++++++ 3 files changed, 20 insertions(+), 1 deletion(-) diff --git a/.gitignore b/.gitignore index c88ccc1b3a..67721590dc 100644 --- a/.gitignore +++ b/.gitignore @@ -20,3 +20,4 @@ env/ venv/ .idea/ *.iml +.venv/ diff --git a/docker/types/containers.py b/docker/types/containers.py index 598188a25e..72813dc9cd 100644 --- a/docker/types/containers.py +++ b/docker/types/containers.py @@ -382,8 +382,17 @@ def __init__(self, version, binds=None, port_bindings=None, 'security_opt', security_opt, 'list' ) - self['SecurityOpt'] = security_opt + filtered = [] + for opt in security_opt: + if opt == "systempaths=unconfined": + self['MaskedPaths'] = [] + self['ReadonlyPaths'] = [] + else: + filtered.append(opt) + + self['SecurityOpt'] = filtered + if sysctls: if not isinstance(sysctls, dict): raise host_config_type_error('sysctls', sysctls, 'dict') diff --git a/tests/unit/api_test.py b/tests/unit/api_test.py index 3ce127b346..a9943e3ca7 100644 --- a/tests/unit/api_test.py +++ b/tests/unit/api_test.py @@ -324,6 +324,15 @@ def test_create_host_config_secopt(self): assert result['SecurityOpt'] == security_opt with pytest.raises(TypeError): self.client.create_host_config(security_opt='wrong') + + def test_create_host_config_systempaths_unconfined(self): + result = self.client.create_host_config( + security_opt=["systempaths=unconfined"] + ) + + assert result['MaskedPaths'] == [] + assert result['ReadonlyPaths'] == [] + assert result['SecurityOpt'] == [] def test_stream_helper_decoding(self): status_code, content = fake_api.fake_responses[f"{url_prefix}events"]()