[systemd-devel] Docker vs PrivateTmp

[Lokesh Mandvekar]

On Sun, Jan 18, 2015 at 11:38:12PM -0500, Lars Kellogg-Stedman wrote:
> On Sun, Jan 18, 2015 at 08:50:35PM -0500, Colin Walters wrote:
> > On Sat, Jan 17, 2015, at 11:02 PM, Lars Kellogg-Stedman wrote:
> > > Hello all,
> > > 
> > > With systemd 216 on Fedora 21 (kernel 3.17.8), I have run into an odd
> > > behavior concerning the PrivateTmp directive, and I am looking for
> > > help identifying this as:
> > > 
> > > - Everything Is Working As Designed, Citizen
> > > - A bug in Docker (some mount flag is being set incorrectly?)
> > 
> > This should be fixed by:
> > http://pkgs.fedoraproject.org/cgit/docker-io.git/commit/?id=6c9e373ee06cb1aee07d3cae426c46002663010d
> > 
> > i.e. having docker.service use MountFlags=private, so its mounts
> > aren't visible to other processes.
> 
> Colin,
> 
> Thanks for the pointer.
> 
> It seems as if using MountFlags=private is going to cause a new set of
> problems:
> 
> Imagine that I am a system administrator using Docker to containerize
> services.  I want to serve set up a webserver container on my Docker
> host, so I mount the web content from a remote server:
> 
>     mount my-fancy-server:/vol/content /content
> 
> And then expose that as a Docker volume:
> 
>     docker run -v /content:/content webserver
> 
> This will fail mysteriously, because with MountFlags=private, the
> mount of my-fancy-server:/vol/content on /content won't be visible to
> Docker containers.  I will spend fruitless hours trying to figure out
> why such a seemingly simple operation is failing.
> 
> I think we actually want MountFlags=slave, which will permit mounts
> from the global namespace to propagate into the service namespace
> without permitting propagation in the other direction.  It seems like
> this would the Least Surprising behavior.

Copying dwalsh


-- 
Lokesh
Freenode, OFTC: lsm5
GPG: 0xC7C3A0DD
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 819 bytes
Desc: not available
URL: <http://lists.freedesktop.org/archives/systemd-devel/attachments/20150118/79832b12/attachment.sig>