Mount SMB/CIFS share within a Docker container

Question

I have a web application running in a Docker container. This application needs to access some files on our corporate file server (Windows Server with an Active Directory domain controller). The files I'm trying to access are image files created for our clients and the web application displays them as part of the client's portfolio.

On my development machine I have the appropriate folders mounted via entries in /etc/fstab and the host mount points are mounted in the Docker container via the --volume argument. This works perfectly.

Now I'm trying to put together a production container which will be run on a different server and which doesn't rely on the CIFS share being mounted on the host. So I tried to add the appropriate entries to the /etc/fstab file in the container & mounting them with mount -a. I get mount error(13): Permission denied.

A little research online led me to this article about Docker security. If I'm reading this correctly, it appears that Docker explicitly denies the ability to mount filesystems within a container. I tried mounting the shares read-only, but this (unsurprisingly) also failed.

So, I have two questions:

1. Am I correct in understanding that Docker prevents any use of mount inside containers?

2. Can anyone think of another way to accomplish this without mounting a CIFS share on the host and then mounting the host folder in the Docker container?

Answer 1

Yes, Docker is preventing you from mounting a remote volume inside the container as a security measure. If you trust your images and the people who run them, then you can use the --privileged flag with docker run to disable these security measures.

Further, you can combine --cap-add and --cap-drop to give the container only the capabilities that it actually needs. (See documentation) The SYS_ADMIN capability is the one that grants mount privileges.

Answer 2

1. yes
2. There is a closed issue mount.cifs within a container

https://github.com/docker/docker/issues/22197

according to which adding

--cap-add SYS_ADMIN --cap-add DAC_READ_SEARCH

to the run options will make mount -t cifs operational.

I tried it out and:

mount -t cifs //<host>/<path> /<localpath> -o user=<user>,password=<user>

within the container then works