How to fix Error response from daemon: error setting label on mount source in Docker

DockerINTERMEDIATEMEDIUMUpdated Dec 6, 2025· 171 views

This error occurs when Docker tries to relabel a bind-mounted directory for SELinux but is not allowed to do so. The fix involves removing the :z/:Z suffix, using --security-opt label:disable, or manually setting SELinux contexts.

Quick fix

Fixes Error response from daemon: error setting label on mount source

# In docker run command, look for patterns like:
docker run -v /:/hostfs:z myimage
docker run -v /etc/localtime:/etc/localtime:Z myimage

# In docker-compose.yml:
volumes:
  - /usr:/hostfs:z  # This will fail
  - /etc:/etc:Z     # This will also fail
  1. Identify the problematic volume mount
  2. Remove the :z or :Z suffix from protected paths
  3. Use --security-opt label:disable if needed
  4. Use a subdirectory instead of root paths
docker — error
# In docker run command, look for patterns like:
docker run -v /:/hostfs:z myimage
docker run -v /etc/localtime:/etc/localtime:Z myimage
# In docker-compose.yml:
volumes:
  - /usr:/hostfs:z  # This will fail
  - /etc:/etc:Z     # This will also fail
Error response from daemon: error setting label on mount source

What this error means

When you mount a host directory into a Docker container on a system with SELinux enabled, Docker can optionally relabel the files to match the container's SELinux context. This is triggered by adding the `:z` (shared) or `:Z` (private) suffix to your volume mount. However, SELinux does not allow relabeling of certain system directories like `/`, `/usr`, `/etc`, or other protected paths. When you try to mount these directories with the `:z` or `:Z` flag, Docker attempts the relabel operation, SELinux blocks it, and you get this "error setting label on mount source" message. This is a security feature, not a bug. SELinux prevents relabeling of critical system directories because doing so could render your host system inoperable or create security vulnerabilities.

Typical symptoms

  • Container fails to start with 'error setting label on mount source' message
  • Error occurs only when using :z or :Z suffix on volume mounts
  • The error mentions 'SELinux relabeling of /path is not allowed'
  • Issue appears on RHEL, CentOS, Fedora, or other SELinux-enabled systems
  • Same container works fine on Ubuntu, Debian, or systems with SELinux disabled
  • Docker Compose services fail during 'docker-compose up' with volume mount errors

Common causes

  1. Using :z or :Z flag on a mount of /, /usr, /etc, or other protected system directories (most common)
  2. Attempting to bind-mount a filesystem mountpoint directly with SELinux relabel flags
  3. The host path doesn't exist or is a special filesystem that doesn't support SELinux labels
  4. Docker daemon is running with --selinux-enabled but the volume mount target is incompatible
  5. Using :Z (private) flag when the directory needs to be shared across containers
  6. Incorrect SELinux context on source directory that conflicts with container expectations

How to fix "Error response from daemon: error setting label on mount source"

1Identify the problematic volume mount

First, check which volume mount is causing the issue. Look at your docker run command or docker-compose.yml for mounts with :z or :Z suffixes:

bash
# In docker run command, look for patterns like:
docker run -v /:/hostfs:z myimage
docker run -v /etc/localtime:/etc/localtime:Z myimage

# In docker-compose.yml:
volumes:
  - /usr:/hostfs:z  # This will fail
  - /etc:/etc:Z     # This will also fail

Note which paths are being mounted with SELinux relabel flags.

2Remove the :z or :Z suffix from protected paths

For system directories that cannot be relabeled, simply remove the SELinux suffix:

Before (fails):

bash
docker run -v /:/hostfs:z myimage

After (works):

bash
docker run -v /:/hostfs myimage

For docker-compose.yml:

Before:

yaml
volumes:
  - /etc/localtime:/etc/localtime:Z

After:

yaml
volumes:
  - /etc/localtime:/etc/localtime:ro

The :ro (read-only) flag is often appropriate for system paths and doesn't trigger relabeling.

3Use --security-opt label:disable if needed

If your container needs write access to system directories and removing the :z flag causes permission issues, disable SELinux labeling for that container:

bash
docker run --security-opt label:disable -v /etc:/etc myimage

For docker-compose.yml:

yaml
services:
  myservice:
    image: myimage
    security_opt:
      - label:disable
    volumes:
      - /etc:/etc

Warning: This disables SELinux protection for that container. Only use this when necessary and understand the security implications.

4Use a subdirectory instead of root paths

Instead of mounting protected system directories, create a dedicated subdirectory:

bash
# Instead of mounting /usr:
mkdir -p /data/app-files
docker run -v /data/app-files:/app:z myimage

# Instead of mounting root filesystem:
mkdir -p /data/hostdata
cp -r /needed/files /data/hostdata/
docker run -v /data/hostdata:/hostdata:z myimage

This allows SELinux relabeling to work properly since /data is not a protected path.

5Manually set SELinux context with chcon

For directories you control, you can set the SELinux context manually instead of using :z/:Z:

bash
# Set the container-friendly context on your directory
sudo chcon -Rt svirt_sandbox_file_t /path/to/your/directory

# Then mount without the :z flag
docker run -v /path/to/your/directory:/app myimage

To make this permanent (survives relabels):

bash
sudo semanage fcontext -a -t svirt_sandbox_file_t "/path/to/your/directory(/.*)?"
sudo restorecon -Rv /path/to/your/directory
6Verify the fix works

Test your container starts successfully:

bash
# Start container with corrected volume mount
docker run -v /your/path:/container/path myimage

# For docker-compose
docker-compose up -d

# Check container is running
docker ps

If the container starts without the SELinux relabel error, the fix is complete.

Advanced notes

### Understanding :z vs :Z Flags

- :z (lowercase) - Indicates the content is shared among multiple containers. Docker labels the content with a shared content label that all containers can access.
- :Z (uppercase) - Indicates the content is private to one container. Docker labels it with a unique MCS (Multi-Category Security) label specific to that container.

Using :Z on a directory and then trying to share it with another container will fail because the second container has a different MCS label.

### Which Paths Cannot Be Relabeled

SELinux protects critical system paths from relabeling:
- Root filesystem (/)
- /usr and its subdirectories
- /etc and its subdirectories
- /var (partially protected)
- Mounted filesystems (NFS, CIFS, etc.)

### Checking SELinux Status

bash
# Check if SELinux is enabled
getenforce

# Check SELinux context of a file/directory
ls -Z /path/to/check

# Check container's SELinux context
docker inspect --format='{{.ProcessLabel}}' container_name

### Running with --privileged (Not Recommended)

While --privileged can bypass this error, it's extremely dangerous:

bash
# DON'T do this in production
docker run --privileged -v /:/hostfs myimage

Privileged containers have root-level access to the host and bypass all security controls. Only use for debugging or specific trusted workloads.

### Docker Daemon SELinux Configuration

Check if Docker is running with SELinux support:

bash
docker info | grep -i selinux

If you see selinux-enabled: true, SELinux labeling is active. This can be disabled in /etc/docker/daemon.json:

json
{
  "selinux-enabled": false
}

Warning: Disabling SELinux support system-wide reduces container isolation security.

### Kubernetes and SELinux

In Kubernetes, use seLinuxOptions in your pod spec or the SELinux mount option:

yaml
spec:
  containers:
  - name: mycontainer
    securityContext:
      seLinuxOptions:
        type: spc_t

Frequently asked questions

What does "Error response from daemon: error setting label on mount source" mean?
When you mount a host directory into a Docker container on a system with SELinux enabled, Docker can optionally relabel the files to match the container's SELinux context. This is triggered by adding the :z (shared) or :Z (private) suffix to your volume mount. However, SELinux does not allow relabeling of certain system directories like /, /usr, /etc, or other protected paths.
How do I fix "Error response from daemon: error setting label on mount source"?
This error occurs when Docker tries to relabel a bind-mounted directory for SELinux but is not allowed to do so. The fix involves removing the :z/:Z suffix, using --security-opt label:disable, or manually setting SELinux contexts.
What causes "Error response from daemon: error setting label on mount source"?
Using :z or :Z flag on a mount of /, /usr, /etc, or other protected system directories (most common) Attempting to bind-mount a filesystem mountpoint directly with SELinux relabel flags The host path doesn't exist or is a special filesystem that doesn't support SELinux labels
Is the "Error response from daemon: error setting label on mount source" error serious?
It is a medium-severity error — more of a blocker than a risk. The steps above resolve it.

Official resources & further reading