76

I have a web application running in a Docker container. This application needs to access some files on our corporate file server (Windows Server with an Active Directory domain controller). The files I'm trying to access are image files created for our clients and the web application displays them as part of the client's portfolio.

On my development machine I have the appropriate folders mounted via entries in /etc/fstab and the host mount points are mounted in the Docker container via the --volume argument. This works perfectly.

Now I'm trying to put together a production container which will be run on a different server and which doesn't rely on the CIFS share being mounted on the host. So I tried to add the appropriate entries to the /etc/fstab file in the container & mounting them with mount -a. I get mount error(13): Permission denied.

A little research online led me to this article about Docker security. If I'm reading this correctly, it appears that Docker explicitly denies the ability to mount filesystems within a container. I tried mounting the shares read-only, but this (unsurprisingly) also failed.

So, I have two questions:

  1. Am I correct in understanding that Docker prevents any use of mount inside containers?

  2. Can anyone think of another way to accomplish this without mounting a CIFS share on the host and then mounting the host folder in the Docker container?

Kryten
  • 15,230
  • 6
  • 45
  • 68
  • Can you please share the code how you modified /etc/fstab file to have details of network drive? Also, have you done all this in DOCKERFILE? – Ankush Jain May 03 '20 at 17:33
  • 1
    @AnkushJain I don't do this very often, but when I do, I usually refer to [this page of documentation](https://wiki.ubuntu.com/MountWindowsSharesPermanently) – Kryten May 04 '20 at 15:12
  • 2
    I wrote a blog here for a complete C#.NET based solution - https://coderjony.com/blogs/mount-a-windows-share-on-linux-container-using-cnet/ – Ankush Jain Sep 03 '20 at 07:14

5 Answers5

62

Yes, Docker is preventing you from mounting a remote volume inside the container as a security measure. If you trust your images and the people who run them, then you can use the --privileged flag with docker run to disable these security measures.

Further, you can combine --cap-add and --cap-drop to give the container only the capabilities that it actually needs. (See documentation) The SYS_ADMIN capability is the one that grants mount privileges.

Geordie
  • 1,920
  • 2
  • 24
  • 34
Nathaniel Waisbrot
  • 23,261
  • 7
  • 71
  • 99
34
  1. yes
  2. There is a closed issue mount.cifs within a container

https://github.com/docker/docker/issues/22197

according to which adding

--cap-add SYS_ADMIN --cap-add DAC_READ_SEARCH

to the run options will make mount -t cifs operational.

I tried it out and:

mount -t cifs //<host>/<path> /<localpath> -o user=<user>,password=<user>

within the container then works

Wolfgang Fahl
  • 15,016
  • 11
  • 93
  • 186
16

You could use the smbclient command (part of the Samba package) to access the SMB/CIFS server from within the Docker container without mounting it, in the same way that you might use curl to download or upload a file.

There is a question on StackExchange Unix that deals with this, but in short:

smbclient //server/share -c 'cd /path/to/file; put myfile'

For multiple files there is the -T option which can create or extract .tar archives, however this looks like it would be a two step process (one to create the .tar and then another to extract it locally). I'm not sure whether you could use a pipe to do it in one step.

Malvineous
  • 25,144
  • 16
  • 116
  • 151
4

You can use a Netshare docker volume plugin which allows to mount remote CIFS/Samba as volumes.

andrey
  • 588
  • 1
  • 8
  • 14
  • 1
    Since the website is no longer available, here is a link to the project's Github page: https://github.com/ContainX/docker-volume-netshare Note that the last commit was in 2020 – Jayrassic Jan 11 '23 at 13:02
4

Do not make your containers less secure by exposing many ports just to mount a share. Or by running it as --privileged

Here is how I solved this issue:

  • First mount the volume on the server that runs docker.

sudo mount -t cifs -o username=YourUserName,uid=$(id -u),gid=$(id -g) //SERVER/share ~/WinShare

Change the username, SERVER and WinShare here. This will ask your sudo password, then it will ask password for the remote share.

Let's assume you created WinShare folder inside your home folder. After running this command you should be able to see all the shared folders and files in WinShare folder. In addition to that since you use the uidand gid tags you will have write access without using sudo all the time.

  • Now you can run your container by using -v tag and share a volume between the server and the container.

Let's say you ran it like the following.

docker run -d --name mycontainer -v /home/WinShare:/home 2d244422164

You should be able to access the windows share and modify it from your container now.

To test it just do:

docker exec -it yourRunningContainer /bin/bash

cd /Home

touch testdocfromcontainer.txt

You should see testdocfromcontainer.txt in the windows share.

nPcomp
  • 8,637
  • 2
  • 54
  • 49
  • 9
    This works, but requires changes on the host, and makes problems in multi-user scenarios in which each container shall have the access rights of a particular user. (OP explicitly asked "[solution which] doesn't rely on the CIFS share being mounted on the host".) – hans_meine Sep 23 '19 at 15:36
  • Doesn't seem to work on OSX. There seems to be a special exception being made for mounted filesystems on top of the rootfs. – sherrellbc May 20 '20 at 23:37