3

Using the latest Docker engine, I want to create a container that mounts a volume over the network. But when I try to execute the mount command, I got the error Unable to apply new capability set.. Found out, that Docker restricts permission, like on mounting here. Different sources say, that its necessary to add SYS_ADMIN permission.

I did this, but still not working with the following command: 

docker run --cap-add=SYS_ADMIN --cap-add=DAC_READ_SEARCH --privileged --memory=2g -d --name $containerName $imageName
Community
  • 1
  • 1
Lion
  • 16,606
  • 23
  • 86
  • 148

1 Answers1

4

This seems to work

docker run ... \
  --cap-add SYS_ADMIN \
  --cap-add DAC_READ_SEARCH \
  my_container

Currently you will probably need to be sure to unmount your volume before you stop the container. Otherwise the host will now allow restarting any containers due to an untidy work queue or something. I created a script to stop my container by first unmounting, then killing the CMD process. I run this inside the container when I need to kill it.

umount /mnt/efbo_share -t cifs -l
sleep 1
pkill npm
pkill node

You can read about the unmount issues at these links:

https://github.com/moby/moby/issues/22197

https://github.com/moby/moby/issues/5618

steampowered
  • 11,809
  • 12
  • 78
  • 98