What causes "failed to detect selinux: %w" in k3s-io/k3s?

Inspect the wrapped cause in the full error text (it is a %w wrap)

failed to detect selinux: %w

Error message

failed to detect selinux: %w

What it means

Before writing the containerd config, the agent calls selinuxStatus() (pkg/agent/containerd/selinux.go): selinux.GetEnabled, then CurrentLabel and NewContext to determine whether the process runs in the container_runtime_t context. Any failure from CurrentLabel/NewContext — e.g. cannot read the process label or an unparseable context — is wrapped as 'failed to detect selinux: ...'.

Source

Thrown at pkg/agent/containerd/config_linux.go:101

		return fmt.Errorf("default runtime %s was not found", cfg.DefaultRuntime)
	}

	containerdConfig := templates.ContainerdConfig{
		NodeConfig:            cfg,
		DisableCgroup:         disableCgroup,
		SystemdCgroup:         cfg.AgentConfig.Systemd,
		IsRunningInUserNS:     isRunningInUserNS,
		EnableUnprivileged:    kernel.CheckKernelVersion(4, 11, 0),
		NonrootDevices:        cfg.Containerd.NonrootDevices,
		PrivateRegistryConfig: cfg.AgentConfig.Registry,
		ExtraRuntimes:         extraRuntimes,
		Program:               version.Program,
		NoDefaultEndpoint:     cfg.Containerd.NoDefault,
	}

	selEnabled, selConfigured, err := selinuxStatus()
	if err != nil {
		return fmt.Errorf("failed to detect selinux: %w", err)
	}
	switch {
	case !cfg.SELinux && selEnabled:
		logrus.Warn("SELinux is enabled on this host, but " + version.Program + " has not been started with --selinux - containerd SELinux support is disabled")
	case cfg.SELinux && !selConfigured:
		logrus.Warnf("SELinux is enabled for "+version.Program+" but process is not running in context '%s', "+version.Program+"-selinux policy may need to be applied", SELinuxContextType)
	}

	if err := writeContainerdConfig(cfg, containerdConfig); err != nil {
		return err
	}

	return writeContainerdHosts(cfg, containerdConfig)
}

func Client(address string) (*containerd.Client, error) {
	addr, _, err := util.GetAddressAndDialer(socketPrefix + address)
	if err != nil {

View on GitHub (pinned to 6ba341e396)

Solutions

Inspect the wrapped cause in the full error text (it is a %w wrap)
Give the host a consistent SELinux state: getenforce reports Enforcing/Permissive with /sys/fs/selinux mounted, or SELinux is fully disabled kernel-side
Run the agent as root in a normal host context so label detection can read the process context

Defensive patterns

Strategy: try-catch

Try / catch

if err := containerd.Configure(cfg); err != nil {
    var wrapped *url.Error // placeholder: unwrap with errors.Unwrap to find the selinux cause
    if strings.Contains(err.Error(), "failed to detect selinux") {
        // inspect errors.Unwrap(err): reading /proc label vs parsing context
        // fix host SELinux state, then retry once
    }
}

Prevention

Keep the host SELinux state consistent (enabled+mounted, or disabled kernel-wide) before deploying
Run agents as root in a normal host context, not inside broken chroots
Always read the wrapped cause — 'failed to detect selinux' alone does not say what broke

When it happens

Trigger: The host reports SELinux enabled (GetEnabled true) but reading or parsing the process's SELinux label fails: unusual LSM setups, selinuxfs at a nonstandard path, restricted /proc access, or a malformed current label.

Common situations: Hardened or nested environments; chroots without a proper /proc mount; hosts with a broken SELinux installation; containers pretending to be hosts.

Related errors

AI-assisted analysis of k3s-io/k3s@6ba341e396 (2026-08-15). Data as JSON: /api/errors/c55f990aa7a2c80e. Report an issue: GitHub.