[systemd-devel] Docker vs PrivateTmp
lsm5 at fedoraproject.org
Sun Jan 18 21:20:53 PST 2015
On Sun, Jan 18, 2015 at 11:38:12PM -0500, Lars Kellogg-Stedman wrote:
> On Sun, Jan 18, 2015 at 08:50:35PM -0500, Colin Walters wrote:
> > On Sat, Jan 17, 2015, at 11:02 PM, Lars Kellogg-Stedman wrote:
> > > Hello all,
> > >
> > > With systemd 216 on Fedora 21 (kernel 3.17.8), I have run into an odd
> > > behavior concerning the PrivateTmp directive, and I am looking for
> > > help identifying this as:
> > >
> > > - Everything Is Working As Designed, Citizen
> > > - A bug in Docker (some mount flag is being set incorrectly?)
> > This should be fixed by:
> > http://pkgs.fedoraproject.org/cgit/docker-io.git/commit/?id=6c9e373ee06cb1aee07d3cae426c46002663010d
> > i.e. having docker.service use MountFlags=private, so its mounts
> > aren't visible to other processes.
> Thanks for the pointer.
> It seems as if using MountFlags=private is going to cause a new set of
> Imagine that I am a system administrator using Docker to containerize
> services. I want to serve set up a webserver container on my Docker
> host, so I mount the web content from a remote server:
> mount my-fancy-server:/vol/content /content
> And then expose that as a Docker volume:
> docker run -v /content:/content webserver
> This will fail mysteriously, because with MountFlags=private, the
> mount of my-fancy-server:/vol/content on /content won't be visible to
> Docker containers. I will spend fruitless hours trying to figure out
> why such a seemingly simple operation is failing.
> I think we actually want MountFlags=slave, which will permit mounts
> from the global namespace to propagate into the service namespace
> without permitting propagation in the other direction. It seems like
> this would the Least Surprising behavior.
Freenode, OFTC: lsm5
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Size: 819 bytes
Desc: not available
More information about the systemd-devel