Utilizing Unshare Mount as a Bind Mount Alternative in Unprivileged Docker Containers

Docker containers are an excellent way to package applications and their dependencies for easy deployment. However, when running multiple processes in different containers that need to access the same files or directories, using Docker's default file sharing mechanisms can pose security risks and complications. In such cases, the Unshare mount feature can be an effective alternative to bind mounts for unprivileged Docker containers.

Understanding Unshare Mount

Unshare is a Linux kernel feature that allows a process to split its namespace from the parent process. This means that a container can have its own network stack, PID namespace, UTS namespace, and other namespaces, providing increased security and isolation. Unshare mount, specifically, allows a container to mount a directory from the host filesystem while keeping it isolated from other containers.

Prerequisites

To use Unshare mount, you need:

• A Linux host with Docker installed
• Knowledge of the basics of Docker and containerization

Setting Up the Environment

Let's assume you want to run two containers, one at /path/to/container1, and the other at /path/to/container2, both needing access to directories /some/path and /other/path1 and /other/path2. Here's how to set up the environment:

1. Create a directory on the host for the shared directories:

$ sudo mkdir -p /mnt/shared

2. Create the directories for the containers:

$ mkdir /path/to/container1 /path/to/container2

3. Create the necessary directories inside the containers:

$ docker exec -it container1 sh -c 'mkdir -p /mnt/shared'

$ docker exec -it container2 sh -c 'mkdir -p /mnt/shared'

Mounting the Shared Directories with Unshare

Now, you can mount the shared directories using Unshare:

$ docker run --rm -it --privileged alpine sh -c 'mount --bind /mnt/shared /mnt/shared && exec unshare --mount --bind /mnt/shared /mnt/shared sh' --entrypoint '' \
 --volume "/mnt/shared:/mnt/shared" \
 --publish 8080:80 \
 --name container1 \
 /path/to/container1

Repeat the same command for container2, but replace the name and volume mount:

$ docker run --rm -it --privileged alpine sh -c 'mount --bind /mnt/shared /mnt/shared && exec unshare --mount --bind /mnt/shared /mnt/shared sh' --entrypoint '' \
 --volume "/mnt/shared:/mnt/shared" \
 --publish 8081:80 \
 --name container2 \
 /path/to/container2

This command mounts the shared directory /mnt/shared inside the container using the bind mount, and then uses Unshare to share it with the container without exposing it to other containers or the host.

Using the Shared Directories

Now, both containers can access the shared directories:

$ docker exec -it container1 sh
 / # ls /mnt/shared
 (contents of shared directory)

$ docker exec -it container2 sh
 / # ls /mnt/shared
 (contents of shared directory)

Unshare mount is a powerful alternative to bind mounts for sharing directories between unprivileged Docker containers. By using Unshare, you can maintain the security and isolation benefits of containerization while allowing multiple containers to access the same shared directories.

References

• Docker Unshare Documentation
• Docker User Namespace Remapping
• How to Share a Directory Between Docker Containers