Introduction

The message that Docker CE on RHEL requires container-selinux >= 2.9 means the Docker packages depend on a newer SELinux policy package than the system currently provides. The fix is usually to install or update container-selinux from the correct repository before retrying the Docker installation.

Core Sections

What container-selinux is

container-selinux is not Docker itself. It is the SELinux policy package that defines how container runtimes are allowed to interact with the host system under SELinux enforcement.

On RHEL-family systems, Docker CE often depends on that package because Docker needs the policy rules to work correctly on an SELinux-enabled machine.

If the installed version is too old or missing, package managers fail with a dependency error before Docker can be installed.

Check what is installed now

Start by asking the system what version it already has:

rpm -q container-selinux

Or:

dnf info container-selinux

If the package is absent or the version is lower than required, you need the correct repository enabled before installing Docker CE.

Enable the right repositories

On RHEL, the package may come from channels such as Extras or CodeReady Builder, or from repositories made available through your subscription configuration.

A typical pattern is:

sudo subscription-manager repos --enable=rhel-7-server-extras-rpms

Or on newer releases, enable the appropriate repositories for your version:

sudo subscription-manager repos --list-enabled

The exact repository names depend on the RHEL version. The important point is that Docker CE package dependencies often assume access to repositories that are not enabled by default on every installation.

Install or update the dependency first

Once the repository is available, install or update container-selinux directly.

sudo yum install -y container-selinux

Or with dnf:

sudo dnf install -y container-selinux

Then retry the Docker install:

sudo yum install -y docker-ce docker-ce-cli containerd.io

At that point the dependency resolver should have what it needs.

Why this often happens on RHEL but not elsewhere

Many installation guides are written for CentOS, Fedora, or generic RPM systems. RHEL is more controlled because package availability depends on subscription channels and enabled repositories. That means a Docker command copied from a blog post can fail on RHEL even though it works unchanged on another distribution.

The error is usually not about Docker compatibility. It is about package source availability.

Consider Podman on RHEL-first environments

If you are operating in a strictly RHEL-native environment, Podman is often the path of least resistance because it is distributed through the platform itself and aligns better with Red Hat's packaging model.

That does not mean Docker CE cannot work. It means Docker CE may require more repository and dependency management than the built-in container stack.

Common Pitfalls

• Treating the error as a Docker bug when it is really a missing or outdated OS dependency.
• Following a generic Docker CE guide without enabling the RHEL repositories that provide container-selinux.
• Mixing package instructions across RHEL major versions without checking which repos exist on the current host.
• Disabling SELinux instead of installing the dependency correctly.
• Ignoring the possibility that Podman may be the simpler choice in a RHEL-managed environment.

Summary

• Docker CE on RHEL may require container-selinux >= 2.9 before installation can proceed.
• 'container-selinux is an SELinux policy package, not the Docker engine itself.'
• The fix is usually to enable the right RHEL repositories and install or update that package first.
• Retry the Docker install only after the dependency is available.
• In RHEL-native environments, compare the operational cost of Docker CE with using Podman instead.