bastian/deploy_home
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(podman): stop restorecon walking the TrueNAS CIFS mounts

Browse Source 
restorecon -Frv over the podman volumes tree descends into two SMB shares
mounted inside it -- volumes/photos/immich and volumes/photos/storage, both
from truenas -- so it was relabelling the entire remote photo library over the
network, on a filesystem that cannot store SELinux xattrs at all.

On 2026-08-28 that pinned CPU#0 at 100% system time and the kernel logged six
escalating soft lockups:

  watchdog: BUG: soft lockup - CPU#0 stuck for 1423s! [restorecon:132780]

New process creation starved, so sshd accepted connections and then hung during
session setup, and the host needed a hard reboot. An earlier run the same day
had already been SIGKILLed at 49s, which was the same bug surfacing quietly.

-x keeps it on the local filesystem. Measured: 1,279,231 local files walked and
relabelled in 29.2s, against never finishing before. The mounts are also
x-systemd.automount, so merely walking into them triggers a mount -- there was
never anything there to relabel.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
Bastian de Byl
2026-08-28 11:40:07 -04:00
co-authored by Claude Opus 5
parent ae99ba415e
commit fb09a01c88
1 changed files with 13 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
ansible/roles/podman/handlers/main.yml
+13 -1
View File
@@ -1,8 +1,20 @@
---
# -x keeps this on the local filesystem. Two TrueNAS CIFS shares are mounted
# INSIDE this tree -- volumes/photos/immich and volumes/photos/storage -- and
# without -x restorecon walked the entire remote photo library over SMB,
# relabelling a filesystem that cannot even store SELinux xattrs. On 2026-08-28
# that pinned CPU#0 at 100% system time and the kernel logged escalating soft
# lockups ("BUG: soft lockup - CPU#0 stuck for 1423s! [restorecon]") until the
# host could no longer create login sessions and needed a hard reboot. An
# earlier run the same day had already been SIGKILLed at 49s, which was the
# same problem surfacing quietly.
#
# The mounts are also x-systemd.automount, so merely walking into them triggers
# a mount -- there is nothing to relabel there and never was.
- name: restorecon podman
become: true
ansible.builtin.command: |
restorecon -Frv {{ podman_home }}/.local/share/volumes
restorecon -Frxv {{ podman_home }}/.local/share/volumes
tags:
- podman
- selinux