Reputation: 17879
Using the latest Docker engine, I want to create a container that mounts a volume over the network. But when I try to execute the mount
command, I got the error Unable to apply new capability set.
. Found out, that Docker restricts permission, like on mounting here. Different sources say, that its necessary to add SYS_ADMIN
permission.
I did this, but still not working with the following command:
docker run --cap-add=SYS_ADMIN --cap-add=DAC_READ_SEARCH --privileged --memory=2g -d --name $containerName $imageName
Upvotes: 3
Views: 11856
Reputation: 12062
This seems to work
docker run ... \
--cap-add SYS_ADMIN \
--cap-add DAC_READ_SEARCH \
my_container
Currently you will probably need to be sure to unmount your volume before you stop the container. Otherwise the host will now allow restarting any containers due to an untidy work queue or something. I created a script to stop my container by first unmounting, then killing the CMD process. I run this inside the container when I need to kill it.
umount /mnt/efbo_share -t cifs -l
sleep 1
pkill npm
pkill node
You can read about the unmount issues at these links:
https://github.com/moby/moby/issues/22197
https://github.com/moby/moby/issues/5618
Upvotes: 4