How to fix Error response from daemon: SELinux is not supported with the overlay2 graph driver on this kernel in Docker

Check whether SELinux is enforcing and what driver Docker is trying to use. If dockerd isn't running, look at recent logs.

getenforce
uname -r
sudo docker info --format 'Driver: {{.Driver}}' || true
sudo journalctl -u docker --no-pager | tail -20

If SELinux is Enforcing and the logs show the overlay2/SELinux error, continue below.

fuse-overlayfs supports SELinux labeling on kernels that lack native overlayfs + SELinux. Install the package and configure Docker to use it.

sudo mkdir -p /etc/docker
sudo tee /etc/docker/daemon.json <<'EOF'
{
  "storage-driver": "fuse-overlayfs",
  "selinux-enabled": true
}
EOF
sudo systemctl restart docker
# For rootless: systemctl --user restart docker

After restart, 'docker info' should show 'fuse-overlayfs' as the storage driver.

If you want native overlay2, upgrade to a kernel that includes overlayfs SELinux support (e.g., modern Fedora/RHEL kernels) and ensure container-selinux is current.

# Example on RHEL/Fedora
sudo dnf upgrade kernel container-selinux
sudo systemctl restart docker

Older kernels (e.g., early 3.x/4.x) often cannot run overlay2 with SELinux; upgrading is the cleanest fix.

Overlayfs with SELinux requires features like d_type and XFS ftype=1. If Docker data is on XFS without ftype=1 or a filesystem lacking overlay features, move it.

# Check XFS ftype
sudo xfs_info /var/lib/docker | grep ftype || true
# Move Docker root to a compatible filesystem (example)
sudo systemctl stop docker
sudo mv /var/lib/docker /var/lib/docker.bak
sudo mkdir -p /mnt/docker-root
# mount or create a compatible filesystem at /mnt/docker-root
sudo ln -s /mnt/docker-root /var/lib/docker
sudo systemctl start docker

If ftype is 0 or unsupported, recreate the filesystem with ftype=1 or use ext4.

If you cannot change the kernel immediately, using the legacy "overlay" driver (without SELinux labeling) or temporarily setting SELinux to Permissive can keep you running—only for short-term testing, not production:

# Fallback to overlay driver (no SELinux labels)
sudo tee /etc/docker/daemon.json <<'EOF'
{ "storage-driver": "overlay", "selinux-enabled": false }
EOF
sudo systemctl restart docker

# TEMPORARY: set SELinux to permissive just to confirm the root cause
sudo setenforce 0   # switch back with: sudo setenforce 1

After any change, verify with:

docker info --format 'Driver: {{.Driver}}'
docker run --rm hello-world

Only keep permissive mode long enough to validate; re-enable SELinux or move to fuse-overlayfs/updated kernel.