CODEWITHSUNDEEP
dockerpermissionsdocker-volume
manu
manu

Reputation: 1017

How can Docker container write to a mounted directory with permissions granted through group membership?

Versions

Scenario

I have a directory where multiple users (user-a and user-b) have read/write access through a common group membership (shared), set up via chown:

/media/disk-a/shared/$ ls -la
drwxrwsr-x 4 user-a shared 4096 Oct  7 22:21 .
drwxrwxr-x 7 root   root   4096 Oct  1 19:58 ..
drwxrwsr-x 5 user-a shared 4096 Oct  7 22:10 folder-a
drwxrwsr-x 3 user-a shared 4096 Nov 10 22:10 folder-b

UIDs & GIDs are as following:

uid=1000(user-a) gid=1000(user-a) groups=1000(user-a),1003(shared)
uid=1002(user-b) gid=1002(user-b) groups=1002(user-b),1003(shared)

Relevant /etc/group looks like this:

shared:x:1003:user-a,user-b

When suing into both users, files can be created as expected within the shared directory.

The shared directory is attached to a Docker container via mount binds to /shared/. The Docker container runs as user-b (using the --user "1002:1002" parameter)

$ ps aux | grep user-b
user-b     1347  0.2  1.2 1579548 45740 ?       Ssl  17:47   0:02 entrypoint.sh

id from within the container prints the following, to me okay-looking result:

I have no name!@7a5d2cc27491:/$ id
uid=1002 gid=1002

Also ls -la mirrors its host system equivalent perfectly:

I have no name!@7a5d2cc27491:/shared ls -la
total 16
drwxrwsr-x 4 1000 1003 4096 Oct  7 20:21 .
drwxr-xr-x 1 root root 4096 Oct  8 07:58 ..
drwxrwsr-x 5 1000 1003 4096 Oct  7 20:10 folder-a
drwxrwsr-x 3 1000 1003 4096 Nov 10 20:10 folder-b

Problem

From within the container, I cannot write anything to the shared directory. For touch test I get the following i.e.:

I have no name!@7a5d2cc27491:/shared$ touch test
touch: cannot touch 'test': Permission denied

I can write to a directory which is directly owned by user-b (user & group) and mounted to the container... Simply the group membership seems somehow not to be respected at all.

I have looked into things like user namespace remapping and things, but these seemed to be solutions for something not applying here. What do I miss?

Upvotes: 6

Views: 3722

Answers (1)

mviereck
mviereck

Reputation: 1399

Your container user has gid=1002, but is not member of group shared with gid=1003.

Additionally to --user "1002:1002" you need --group-add 1003. Than the container user is allowed to access the shared folder with gid=1003.

id should show:

I have no name!@7a5d2cc27491:/$ id
uid=1002 gid=1002 groups=1003

Upvotes: 2

Related Questions