CODEWITHSUNDEEP
permissionsmountpodman
JayK
JayK

Reputation: 51

Mount host directory to docker/podman container with correct permissions

Using:

I've created an image based on redhat/ubi8 with the following Dockerfile:

FROM docker.io/redhat/ubi8
RUN dnf install -y gcc-c++ cmake python39 openssh git
RUN useradd -ms /bin/bash foobar -g users
USER foobar
WORKDIR /home/foobar/
RUN mkdir -p .ssh

$ docker build -t mount_test_image .

I run the image from a directory that contains a directory ssh, and I want to mount that directory to /home/foobar/.ssh with ownership of foobar.users

$ ls -l
-rw-r--r--. 1 host_user users   269 Dec  7 09:10 Dockerfile
drwxrwxr-x. 2 host_user users    18 Dec  2 10:41 ssh


docker run -it -d --rm --mount type=bind,src=ssh,target=/home/foobar/.ssh --name=mount_test mount_test_image

However when I enter the container via

docker exec -it mount_test '/bin/sh'

The home directory looks like this:

drwx------. 1 foobar  users  18 Dec  7 17:10 .
drwxr-xr-x. 1 root    root   21 Dec  7 17:10 ..
-rw-r--r--. 1 foobar  users  18 Jun 20 11:31 .bash_logout
-rw-r--r--. 1 foobar  users 141 Jun 20 11:31 .bash_profile
-rw-r--r--. 1 foobar  users 376 Jun 20 11:31 .bashrc
drwxrwxr-x. 2 root    root   18 Dec  2 18:41 .ssh

I obviously get a "permission denied" when trying to access that directory.

sh-4.4$ ls /home/foobar/.ssh
ls: cannot open directory '/home/foobar/.ssh': Permission denied

I tried changing the ownership of the directory on the host to match the uid of the container user, but then it just looks like this:

drwxrwxr-x. 2 nobody  root   18 Dec  2 18:41 .ssh

My host user uid:gid is 501:100 and the container user is 1000:100. Right now I'm just trying to generate an ssh key to upload to bitbucket, but this seems like a simple feature a container should be have. All the tutorials and examples just stop after the --mount command instruction and say "there ya go!". What good is the mount point if you can't read/write it?

EDIT:

I tried on Archlinux using docker instead of podman and it works like one would expect with both -v and --mount. The owner of the mounted directory in the container matches the uid and gid of the host. Is this then a bug in podman or is it just done differently?

Upvotes: 3

Views: 6543

Answers (1)

djoreilly
djoreilly

Reputation: 79

You are using a non-root user (foobar) in a rootless container. You must use --userns=keep-id for the container user to see the mounted volumes.

https://github.com/containers/podman/blob/main/docs/tutorials/rootless_tutorial.md#using-volumes

Upvotes: 2

Related Questions