Docker: 使用 --volume 绑定挂载进行文件权限

9 浏览
0 Comments

Docker: 使用 --volume 绑定挂载进行文件权限

我正在遵循这篇文章的指导:https://denibertovic.com/posts/handling-permissions-with-docker-volumes/,在容器中设置一个--volume绑定挂载,并创建一个与主机用户相同UID的客户容器用户 - 理论上,我的容器用户应该能够访问该挂载点。但对我来说并没有起作用,我正在寻找一些下一步尝试的指导。\n更多背景细节:\n我的Dockerfile从一个alpine基础开始,然后添加python开发包。根据denibertovic的指导,它复制了一个entrypoint.sh脚本。然后跳转到entrpoint.sh脚本。\n

FROM alpine
RUN apk update
RUN apk add bash
RUN apk add python3
RUN apk add python3-dev
RUN apk add su-exec
COPY entrypoint.sh /usr/local/bin/entrypoint.sh
RUN chmod +x /usr/local/bin/entrypoint.sh
ENTRYPOINT ["/usr/local/bin/entrypoint.sh"]

\nentrpoint.sh脚本使用作为环境变量传递的UID向容器添加一个用户。\n

#!/bin/bash
# 添加本地用户
# 使用LOCAL_USER_ID(如果在运行时传入)或者回退到默认值
USER_ID=${LOCAL_USER_ID:-9001}
echo "Starting with UID : $USER_ID"
adduser -s /bin/bash -u $USER_ID -H -D user
export HOME=/home/user
su-exec user "$@"

\n容器无问题地构建。\n然后我用以下命令行运行它:\n

sudo docker run -it -e LOCAL_USER_ID=`id -u` -v `realpath ../..`:/ws django-runtime /bin/bash

\n你会看到我传入了我的主机UID以映射到容器用户的UID,并且我要求从我的本地工作目录到容器中的/ws挂载点进行挂载。\n从容器内的bash shell中,我可以看到/ws的所有者是\'user\'的UID,与我的\'id\'相匹配。然而,当我尝试列出/ws的内容时,我遇到了权限被拒绝的错误,如下所示:\n

[dleclair@localhost runtime]$ sudo docker run -it -e LOCAL_USER_ID=`id -u` -v `realpath ../..`:/ws django-runtime /bin/bash
[sudo] password for dleclair:
Starting with UID : 1000
bash-5.0$ id
uid=1000(user) gid=1000(user) groups=1000(user)
bash-5.0$ ls -la .
total 0
drwxr-xr-x    1 root     root            27 Feb  8 09:15 .
drwxr-xr-x    1 root     root            27 Feb  8 09:15 ..
-rwxr-xr-x    1 root     root             0 Feb  8 09:15 .dockerenv
drwxr-xr-x    1 root     root            18 Feb  8 07:44 bin
drwxr-xr-x    5 root     root           360 Feb  8 09:15 dev
drwxr-xr-x    1 root     root            91 Feb  8 09:15 etc
drwxr-xr-x    2 root     root             6 Jan 16 21:52 home
drwxr-xr-x    1 root     root            17 Jan 16 21:52 lib
drwxr-xr-x    5 root     root            44 Jan 16 21:52 media
drwxr-xr-x    2 root     root             6 Jan 16 21:52 mnt
drwxr-xr-x    2 root     root             6 Jan 16 21:52 opt
dr-xr-xr-x  119 root     root             0 Feb  8 09:15 proc
drwx------    2 root     root             6 Jan 16 21:52 root
drwxr-xr-x    1 root     root            21 Feb  8 07:44 run
drwxr-xr-x    1 root     root            21 Feb  8 08:22 sbin
drwxr-xr-x    2 root     root             6 Jan 16 21:52 srv
dr-xr-xr-x   13 root     root             0 Feb  8 01:58 sys
drwxrwxrwt    2 root     root             6 Jan 16 21:52 tmp
drwxr-xr-x    1 root     root            19 Feb  8 07:44 usr
drwxr-xr-x    1 root     root            19 Jan 16 21:52 var
drwxrwxr-x    5 user     user           111 Feb  8 02:15 ws
bash-5.0$
bash-5.0$
bash-5.0$ cd /ws
bash-5.0$ ls -la
ls: can't open '.': Permission denied
total 0
bash-5.0$

\n欢迎大家提供任何指导。谢谢!

0
0 Comments

在使用Docker进行文件权限绑定时遇到了问题,经过进一步搜索,我在这里找到了解决方案:Permission denied on accessing host directory in Dockerhttp://www.projectatomic.io/blog/2015/06/using-volumes-with-docker-can-cause-problems-with-selinux/

简而言之,问题出在SELinux对于卷挂载的默认标签阻止了对挂载文件的访问。解决方法是在-v命令行参数的末尾添加':Z',强制Docker为挂载的文件设置适当的标志以允许访问。

因此,命令行变成了:

sudo docker run -it -e LOCAL_USER_ID=`id -u` -v `realpath ../..`:/ws:Z django-runtime /bin/bash

非常顺利地解决了问题。

0