How do I mount --bind inside a Docker container?

docker bind mount
Morpheu5 picture Morpheu5 · Apr 11, 2016 · Viewed 12.4k times · Source

I have this container based on debian:jessie (but this is not very relevant as I had the same issue with alpine:3.3). I get to the point where I need to

mount --bind /htdocs/www /home/user/example.com/www

and I get

mount: permission denied

I can't find anything in any kernel log, and -vvv yields nothing interesting. I obviously can do this on the host (with any other pair of subtree/node). In my example above /htdocs/www is the mountpoint of a Docker volume, but it doesn't appear like it's of any importance, as I can't mount --bind any pair of subtree/node inside the container.

Answer

helmbert picture helmbert · Apr 11, 2016

For using the mount system call, you need the CAP_SYS_ADMIN capability. By default, Docker drops all capabilities when spawning a container (meaning that even as root, you're not allowed to do everything). See the mount(2) man page for more information.

You can start your container with the --cap-add=SYS_ADMIN flag to add this capability to your container:

root@host > docker run --rm -it --cap-add=SYS_ADMIN debian:jessie
root@ee0b1d5fe546:/# mkdir /mnt/test
root@ee0b1d5fe546:/# mount --bind /home /mnt/test/
root@ee0b1d5fe546:/#

Use this with caution. Do not run untrusted software in a privileged container.

Related questions

Docker Error bind: address already in use

When I run docker-compose up in my Docker project it failes with the following message: Error starting userland proxy: listen tcp 0.0.0.0:3000: bind: address already in use netstat -pna | grep 3000 shows this: tcp 0 0 0.0.0.0:3000 0.0.0.0:* LISTEN - I've already tried docker-compose down, but …

Read More
Bind a directory to a docker container

I'm building a test project that requires a module outside of the project directory. The project folder is in docker, and I would like to bind that module directory to the docker container of my project. Is it even possible …

Read More
How to get a Docker container's IP address from the host

Is there a command I can run to get the container's IP address right from the host after a new container is created? Basically, once Docker creates the container, I want to roll my own code deployment and container configuration …

Read More