Add SELinux note after moving the binary in the self-hosting deployment guides

[carlosupreme]

Description

Closes #3643

The four production deployment guides instruct users to move the binary into /usr/local/bin. On systems running SELinux in enforcing mode (Fedora, RHEL, Rocky Linux, AlmaLinux, CentOS Stream, and Amazon Linux on the AWS page), mv preserves the binary's original SELinux context instead of relabeling it for its destination. As a result, systemd cannot execute it, and step 4 fails with:

Failed at step EXEC spawning /usr/local/bin/meilisearch: Permission denied

The chown command in step 2 does not fix this issue because file ownership and SELinux labels are separate. Therefore, a user following the guide exactly may end up with a service that does not start and an error that does not clearly indicate the cause.

This PR adds a <Note> immediately after the move step in each guide. It identifies the affected distributions, quotes the error message verbatim so it is searchable, links to step 4 where the failure occurs, and provides the following fix:

sudo restorecon -v /usr/local/bin/meilisearch

Pages changed:

• resources/self_hosting/deployment/running_production.mdx
• resources/self_hosting/deployment/aws.mdx
• resources/self_hosting/deployment/gcp.mdx
• resources/self_hosting/deployment/digitalocean.mdx

The note is duplicated across the four pages rather than extracted into a shared snippet, matching how the existing Meilisearch Cloud <Note> is already repeated across them. Each copy uses sudo for the command that restores the binary's SELinux context. The AWS version also lists Amazon Linux because that guide supports it.

AI usage disclosure

AI tools were used to review the wording and consistency of the SELinux troubleshooting notes. The technical behavior and commands were manually verified.

Checklist

For internal Meilisearch team member only:

• I checked and followed our internal guidelines
• ⚠️ I updated the code samples according to our internal guidelines

For external maintainers:

• Did you use any AI tool while implementing this PR (code, tests, docs, etc.)? If yes, disclose it in the PR description and describe what it was used for. AI usage is allowed when it is disclosed.
• Have you made sure that the title is accurate and descriptive of the changes?

Summary by CodeRabbit

• Documentation
  • Added SELinux troubleshooting guidance to self-hosted deployment documentation.
  • Explained how to resolve systemd execution failures caused by incorrect binary security contexts.
  • Added commands to restore and verify the required bin_t SELinux label across supported Linux distributions and deployment platforms.

[coderabbitai]

📝 Walkthrough

Walkthrough

The four self-hosting deployment guides now include SELinux troubleshooting. They describe the systemd execution failure and show how to restore and verify the Meilisearch binary’s bin_t security context.

Changes

SELinux deployment guidance

Layer / File(s)	Summary
Document SELinux context troubleshooting resources/self_hosting/deployment/aws.mdx, resources/self_hosting/deployment/digitalocean.mdx, resources/self_hosting/deployment/gcp.mdx, resources/self_hosting/deployment/running_production.mdx	The guides identify affected distributions, describe the systemd permission error, and provide restorecon and ls -Z commands for the Meilisearch binary.

Estimated code review effort: 2 (Simple) | ~10 minutes

Poem

A rabbit checks /usr/local/bin,
Then finds the label tucked within.
restorecon sets the context right,
ls -Z confirms the type.
The service starts beneath the moon—
The rabbit thumps a happy tune!

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	The four guides add the requested SELinux distributions, failure explanation, error message, restorecon fix, and label verification from issue #3643.
Out of Scope Changes check	✅ Passed	All changes add SELinux troubleshooting guidance to the four guides identified in issue #3643, with no unrelated scope detected.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: adding SELinux guidance after moving the binary in self-hosting deployment guides.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@resources/self_hosting/deployment/aws.mdx`:
- Line 58: Update the SELinux failure notes in
resources/self_hosting/deployment/aws.mdx:58-58,
resources/self_hosting/deployment/digitalocean.mdx:51-51,
resources/self_hosting/deployment/gcp.mdx:48-48, and
resources/self_hosting/deployment/running_production.mdx:50-50 to explicitly
state before the failure description that mv preserves the binary’s source
SELinux context.

In `@resources/self_hosting/deployment/digitalocean.mdx`:
- Line 56: Update the restorecon command in
resources/self_hosting/deployment/digitalocean.mdx at lines 56-56 and
resources/self_hosting/deployment/running_production.mdx at lines 55-55 to
invoke restorecon with sudo, preserving the existing verbose flag and target
path.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: a3cd42c7-f1ca-4fdf-9f97-768df63f3bed

📥 Commits

Reviewing files that changed from the base of the PR and between 63dbf29 and 446e93b.

📒 Files selected for processing (4)

• resources/self_hosting/deployment/aws.mdx
• resources/self_hosting/deployment/digitalocean.mdx
• resources/self_hosting/deployment/gcp.mdx
• resources/self_hosting/deployment/running_production.mdx