I'm running some services inside of Docker LXC containers on my server and I'm beginning to actually do serious things with them.

One thing I'm not clear on is how user permissions work inside and outside of the container. If, for example, I'm running MySQL in a container and have its data directory set to /data, which is a Docker volume, how do permissions inside and outside of the container affect access policies?

Obviously, the idea is to run MySQL as its own user in the container (ie mysql:mysql) and give it read and write rights to that directory. I assume that this would be fairly straightforward, just chmoding the directory, etc. But how does this work outside of the container? Now that I have this Docker shared volume called 'data,' how do I manage access control to it?

I'm specifically looking to be able to run an unprivileged user outside of the Docker container which will periodically access the MySQL shared volume and backup the data.

How can I setup permissions, users, and groups so that a specific user on the host can read/write files and folders in the Docker shared volume?

  • 2
    With userns (but no docker support for that, yet) the LXC container can be run as unprivileged user. Otherwise the root user inside the container could potentially break out if the container is inappropriately configured. I.e. root on host is root in container in a privileged LXC container. May 11, 2014 at 19:12
  • 1
    root can, by the way, also run unprivileged containers. Important is that a mapping for the userns is defined. May 7, 2015 at 8:19

1 Answer 1


Since the release of 0.9 Docker has dropped LXC and uses its own execution environment, libcontainer. Your question's a bit old but I guess my answer still applies the version you are using.

Quick Answer: To understand the permissions of volumes, you can take the analogy of mount --bind Host-Dir Container-Dir. So to fulfill your requirement you can use any traditional methods for managing permissions. I guess ACL is what you need.

Long Answer: So as in your example we have a container named dock with a volume /data.

docker run -tid --name dock -v /usr/container/Databases/:/data \
    centos:latest /bin/bash

Inside the container our MySQL server has been configured to use the /data as its data directory. So we have our databases in the /data inside the container. And outside the container on the Host OS, we have mounted this /data volume from /usr/container/Databases/ and we assign a normal user bob to take backups of the databases. From the host machine we'll configure ACLs for user bob.

useradd -u 3000 bob
usermod -R o=--- /usr/container/Databases/
setfacl -R -m u:bob:rwx /usr/container/Databases/
setfacl -R -d -m u:bob:rwx /usr/container/Databases/

To test it out lets take a backup with user bob.

su - bob
tar -cvf container-data.tar /usr/container/Databases/

And tar will list out and you can see that our user was able to access all the files.

Now from inside the container if you check with getfacl you will notice that instead of bob it shows 3000. This is because the UID of bob is 3000 and there is no such user in the container so it simply displays the UID it receives from the meta data. Now if you create a user in your container with useradd -u 3000 bob you will notice that now the getfacl shows the name bob instead of 3000.

Summary: So the user permissions you assign from either inside or outside the container reflects to both environments. So to manage the permissions of volumes, UIDs in host machine must be different from the UIDs in the container.

  • Docker for Ubuntu at least has a package name of lxc-docker, does that mean it's not using LXC? Does the above still apply in this case? Sep 7, 2014 at 4:03
  • @NaftuliTzviKay oh, sorry. Then its got to be using LXC(I guess apt-get info may have the details) because in ubuntu there is another package docker.io which I used. I didnt go with Ubuntu for long, as Docker and RedHat have joined hands now. So its better to go with RHEL or CentOS as the base OS, or otherwise you can simply use LXC.
    – beginer
    Sep 7, 2014 at 6:02
  • 1
    Even in lxc-docker this seems to work as planned. I created a user with uid of 3000, touched a file in a shared volume, and was able to see from the host OS that the file existed and was owned by a user with id 3000. Sep 7, 2014 at 20:14

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .