How to fix Error response from daemon: SELinux is not supported with the overlay2 graph driver on this kernel in Docker

What this error means

Docker throws this error when it tries to initialize the overlay2 storage driver while SELinux enforcement is on, but the running kernel doesn't support overlayfs with SELinux labeling. To avoid unlabeled writes and permission denials, dockerd refuses to run overlay2 and exits early. This is common on older RHEL/CentOS kernels or when forcing overlay2 in rootless mode on SELinux systems. The fix is to use a storage driver that works with SELinux on your kernel (fuse-overlayfs or overlay), or upgrade to a kernel and policy set that supports overlay2 with SELinux.

Typical symptoms

• Docker service fails to start and journalctl shows 'SELinux is not supported with the overlay2 graph driver on this kernel'.
• docker info errors out or never reports a storage driver when SELinux is enforcing.
• Container commands (run/build/compose) fail immediately with the daemon error before any image is pulled.
• Rootless setup tools warn that overlay2 is blocked when SELinux is enabled.

Common causes

1. Kernel lacks SELinux-enabled overlayfs support (common on older RHEL/CentOS kernels or custom builds).
2. Rootless Docker forcing overlay2 while SELinux is enforcing; rootless needs fuse-overlayfs for SELinux systems.
3. Docker data root sits on XFS without ftype=1 or missing overlayfs features, so SELinux + overlay2 is rejected.
4. daemon.json explicitly forces overlay2 on a distro that defaults to fuse-overlayfs/overlay for SELinux compatibility.
5. Outdated or missing container-selinux policy after an OS upgrade prevents overlay mounts from being labeled.

How to fix "Error response from daemon: SELinux is not supported with the overlay2 graph driver on this kernel"

getenforce
uname -r
sudo docker info --format 'Driver: {{.Driver}}' || true
sudo journalctl -u docker --no-pager | tail -20

sudo mkdir -p /etc/docker
sudo tee /etc/docker/daemon.json <<'EOF'
{
  "storage-driver": "fuse-overlayfs",
  "selinux-enabled": true
}
EOF
sudo systemctl restart docker
# For rootless: systemctl --user restart docker

# Example on RHEL/Fedora
sudo dnf upgrade kernel container-selinux
sudo systemctl restart docker

# Check XFS ftype
sudo xfs_info /var/lib/docker | grep ftype || true
# Move Docker root to a compatible filesystem (example)
sudo systemctl stop docker
sudo mv /var/lib/docker /var/lib/docker.bak
sudo mkdir -p /mnt/docker-root
# mount or create a compatible filesystem at /mnt/docker-root
sudo ln -s /mnt/docker-root /var/lib/docker
sudo systemctl start docker

# Fallback to overlay driver (no SELinux labels)
sudo tee /etc/docker/daemon.json <<'EOF'
{ "storage-driver": "overlay", "selinux-enabled": false }
EOF
sudo systemctl restart docker

# TEMPORARY: set SELinux to permissive just to confirm the root cause
sudo setenforce 0   # switch back with: sudo setenforce 1

docker info --format 'Driver: {{.Driver}}'
docker run --rm hello-world

Advanced notes

Frequently asked questions

What does "Error response from daemon: SELinux is not supported with the overlay2" mean?

Docker throws this error when it tries to initialize the overlay2 storage driver while SELinux enforcement is on, but the running kernel doesn't support overlayfs with SELinux labeling. To avoid unlabeled writes and permission denials, dockerd refuses to run overlay2 and exits early. This is common on older RHEL/CentOS kernels or when forcing overlay2 in rootless mode on SELinux systems.

How do I fix "Error response from daemon: SELinux is not supported with the overlay2"?

Docker fails to start containers when SELinux labeling is enabled but the kernel lacks overlay2/overlayfs support. Use fuse-overlayfs or a compatible driver, or upgrade to a kernel that supports SELinux with overlay2.

What causes "Error response from daemon: SELinux is not supported with the overlay2"?

Kernel lacks SELinux-enabled overlayfs support (common on older RHEL/CentOS kernels or custom builds). Rootless Docker forcing overlay2 while SELinux is enforcing; rootless needs fuse-overlayfs for SELinux systems. Docker data root sits on XFS without ftype=1 or missing overlayfs features, so SELinux + overlay2 is rejected.

Is the "Error response from daemon: SELinux is not supported with the overlay2" error serious?

Yes. This is a high-severity error that usually blocks work until it is fixed, but the steps above resolve it.

Related errors

• Error response from daemon: invalid mount config: mount path must be absolute

  How to fix 'mount path must be absolute' in Docker

  LOW

• Memory reservation cannot be larger than memory limit

  How to fix 'Memory reservation cannot be larger than memory limit' in Docker

  LOW

• Mounts denied: The path /host/path is not shared from the host and is not known to Docker

  How to fix 'Mounts denied: path is not shared from host' in Docker

  MEDIUM

• Minimum memory limit allowed is 6MB

  How to fix 'Minimum memory limit allowed is 6MB' in Docker

  LOW

• WSL 2 requires an update to its kernel component

  How to fix 'WSL 2 requires an update to its kernel component' in Docker

  MEDIUM

• dial tcp: i/o timeout

  How to fix 'dial tcp: i/o timeout' in Docker

  MEDIUM

Official resources & further reading

• 📚Docker Official Documentation
• 📖
  Docker docs: overlay2/overlay storage driver requirements(Official Docs)
• 💬
  Stack Overflow: SELinux is not supported with the overlay graph driver(Stack Overflow)
• 🐙
  moby/moby #50584: SELinux support for overlay2/rootless(GitHub)