Arch Linux

Nimamoh

Member

Registered: 2016-03-05

Posts: 8

Docker user namespace isolation: permission denied with bind mount

Hello,

I enabled user namespace isolation as depicted in archwiki and on docker documentation.

However, when I try to use a bind mount:

# this is fish shell
$ docker run --rm -it -v (pwd)/bmount/:/bmount alpine sh

I get:

docker: Error response from daemon: failed to create shim: OCI runtime create failed: container_linux.go:380: starting container process caused: process_linux.go:545: container init caused: rootfs_linux.go:76: mounting "xxxx/bmount" to rootfs at "/bmount" caused: stat xxxx/bmount: permission denied: unknown.

I managed to get regular docker volume to work without issue. As far as I'm understanding this setup, bind mount should be working given the container has rights on the folder, right?

Here is some more details:
---
I created a dockremap user and group, both having an UID/GID of 200000
Here is the content of /etc/subuid and /etc/subgid

dockremap:200000:65536

dockremap:200000:65536

And docker is configured to use user namespace isolation, here is the /etc/docker/daemon.json

{
  "userns-remap": "dockremap"
}

I made sure the bmount folder I'm trying to bind mount is chown to dockremap

drwxr-xr-x  2 dockremap dockremap 4,0K 24 juin  13:08 bmount

docker info gives this

Client:
Context:    default
Debug Mode: false
Plugins:
  app: Docker App (Docker Inc., v0.9.1-beta3)
  buildx: Build with BuildKit (Docker Inc., v0.5.1-tp-docker)

Server:
Containers: 0
  Running: 0
  Paused: 0
  Stopped: 0
Images: 2
Server Version: 20.10.7
Storage Driver: overlay2
  Backing Filesystem: extfs
  Supports d_type: true
  Native Overlay Diff: false
  userxattr: false
Logging Driver: json-file
Cgroup Driver: systemd
Cgroup Version: 2
Plugins:
  Volume: local
  Network: bridge host ipvlan macvlan null overlay
  Log: awslogs fluentd gcplogs gelf journald json-file local logentries splunk syslog
Swarm: inactive
Runtimes: io.containerd.runtime.v1.linux runc io.containerd.runc.v2
Default Runtime: runc
Init Binary: docker-init
containerd version: 36cc874494a56a253cd181a1a685b44b58a2e34a.m
runc version: b9ee9c6314599f1b4a7f497e1f1f856fe433d3b7
init version: de40ad0
Security Options:
  seccomp
   Profile: default
  userns
  cgroupns
Kernel Version: 5.12.11-arch1-1
Operating System: Arch Linux
OSType: linux
Architecture: x86_64
CPUs: 2
Total Memory: 3.735GiB
Name: CRIQUET
ID: AT7Q:T3HO:HBFF:H7AM:XABE:KY4B:AQ2H:POBZ:YUE3:XGOT:4ROB:SDUX
Docker Root Dir: /var/lib/docker/200000.200000
Debug Mode: false
Registry: https://index.docker.io/v1/
Labels:
Experimental: false
Insecure Registries:
  127.0.0.0/8
Live Restore Enabled: false

$ uname -a

Linux CRIQUET 5.12.11-arch1-1 #1 SMP PREEMPT Wed, 16 Jun 2021 15:25:28 +0000 x86_64 GNU/Linux

gnumdk

Member

Registered: 2009-10-15

Posts: 175

Re: Docker user namespace isolation: permission denied with bind mount

Not sure App&Desktop is the wanted category for this question.

And if you want a real secure docker: https://wiki.archlinux.org/title/Podman