3

I need the mountpoints of all disks attached to a host inside a docker container. The mount information is available in /proc/1/mounts file, but I cannot access that file on all OS.

When I run the following on Ubuntu it's working fine.

docker run -it -v /proc/1/mounts:/tmp/mounts ubuntu:16.04

But on CentOS with SELinux enabled, I cannot mount /proc/1/mounts file. It will give permission denied error.

I also tried /etc/mtab, but since it's a symlink to /proc/self/mounts, the content will change inside the docker container.

Is there any other way to obtain the mount information of the host other than /proc/1/mounts, or should a particular SELinux label be used?

I tried with docker run -it --privileged -v /proc/1/mounts:/tmp/mounts ubuntu:16.04, and it still gives the same error.

  • 1
    This might be a bit overkill, but have you looked at running the container with extended privileges (--privileged)? – Haxiel Apr 12 at 9:46
  • Yes . I tried it also. It still gives the same error. Will add it into the description. – Akhil Mohan Apr 12 at 10:22
  • Try: --security-opt label=type:container_runtime_t – mviereck Apr 18 at 19:14
4

I am making the assumption that you do not strictly require the mounts visible to the init process (pid 1) and that the mounts visible to the docker daemon are sufficient. Normally, they should both have the same mount namespace.

Answer for CentOS docker package

(Using docker 1.13.1 from the CentOS repository)

I can reproduce your problem with /proc/1/mounts. However, using the mounts file of the docker daemon works:

$ docker run -it -v /proc/$(pidof dockerd-current)/mounts:/tmp/mounts ubuntu:16.04

In the docker container, /tmp/mounts then lists the mounts of the host.

Answer for the Docker Community Edition

(Using the external docker-ce 18.09.5 package as described here)

In addition to the problem explained above, the docker-ce package has a problem with the SE Linux context of the containerd service:

# ps xZ | grep containerd
system_u:system_r:unconfined_service_t:s0 5695 ? Ssl   0:00 /usr/bin/containerd
...

We want to have containerd labeled with the type container_runtime_t instead of unconfined_service_t. To this end, the labeling of /usr/bin/containerd has to be updated (general reference):

# ls -Z /usr/bin/dockerd-ce 
-rwxr-xr-x. root root system_u:object_r:container_runtime_exec_t:s0 /usr/bin/dockerd-ce
# ls -Z /usr/bin/containerd
-rwxr-xr-x. root root system_u:object_r:bin_t:s0       /usr/bin/containerd
# semanage fcontext -a -t container_runtime_exec_t /usr/bin/containerd
# restorecon /usr/bin/containerd
# ls -Z /usr/bin/containerd
-rwxr-xr-x. root root system_u:object_r:container_runtime_exec_t:s0 /usr/bin/containerd

Next, restart the containerd daemon:

# systemctl daemon-reload
# systemctl restart containerd
# ps xZ | grep containerd
system_u:system_r:container_runtime_t:s0 6557 ? Ssl   0:00 /usr/bin/containerd

Now, the docker container can be started using the same technique as above (with dockerd instead of dockerd-current):

$ docker run -it -v /proc/$(pidof dockerd)/mounts:/tmp/mounts ubuntu:16.04

Background information

I tested this on CentOS Linux release 7.6.1810.

You can verify that init and the docker daemon have the same mount namespace (i.e. their /proc/[pid]/mounts will show the same mounts):

# readlink /proc/1/ns/mnt /proc/$(pidof dockerd-current)/ns/mnt
mnt:[4026531840]
mnt:[4026531840]

I also verified SE Linux is enabled:

# getenforce
Enforcing

When running your command with the CentOS docker package I get this error message:

$ docker run -it -v /proc/1/mounts:/tmp/mounts ubuntu:16.04
/usr/bin/docker-current: Error response from daemon: oci runtime error: container_linux.go:247: starting container process caused "container init exited prematurely".

Additionally, in /var/log/audit/audit.log, I see the following AVC violation:

type=AVC msg=audit(1555530383.707:214): avc:  denied  { mounton } for  pid=5691 comm="runc:[2:INIT]" path="/var/lib/docker/overlay2/8944062749f8ad19c3ff600e1d5286315227378174b95a952e7b0530927f4dcd/merged/tmp/mounts" dev="proc" ino=45422 scontext=system_u:system_r:container_runtime_t:s0 tcontext=system_u:system_r:init_t:s0 tclass=file permissive=0

This tells us that the SE Linux rules do not allow the source context of type container_runtime_t to do action "mounton" for target context of type "init_t". You can verify that this is the context of /proc/1/mounts, whereas the context of /proc/$(pidof dockerd-current)/mounts matches:

# ls -Z /proc/1/mounts /proc/$(pidof dockerd-current)/mounts
-r--r--r--. root root system_u:system_r:init_t:s0      /proc/1/mounts
-r--r--r--. root root system_u:system_r:container_runtime_t:s0 /proc/5476/mounts
  • Everything you said is correct, the namespaces and security context. But still Iam not able to mount the /proc/$(pidof dockerd)/mounts. It is showing the same error as mounting /proc/1/mounts. Also, I am not having a process dockerd-current, its just dockerd – Akhil Mohan Apr 18 at 8:03
  • Can you specify the CentOS version you are using and the precise error message? – f9c69e9781fa194211448473495534 Apr 18 at 8:05
  • Version : CentOS Linux release 7.6.1810 (Core) Error : docker: Error response from daemon: OCI runtime create failed: container_linux.go:345: starting container process caused "process_linux.go:424: container init caused \"rootfs_linux.go:58: mounting \\\"/proc/5508/mounts\\\" to rootfs \\\"/var/lib/docker/overlay2/37f3d6f3a0c2fda3b89bd4a58722c0c486b19e5afa890fe5770ba120c1244b25/merged\\\" at \\\"/var/lib/docker/overlay2/37f3d6f3a0c2fda3b89bd4a58722c0c486b19e5afa890fe5770ba120c1244b25/merged/tmp/mounts\\\" caused \\\"permission denied\\\"\"": unknown. – Akhil Mohan Apr 18 at 8:08
  • If you do not have the dockerd-current process, could you elaborate on how you are starting the docker service? Using the CentOS docker package (1.13.1-94), starting the docker service with systemctl should bring up the dockerd-current process (/usr/lib/systemd/system/docker.service). – f9c69e9781fa194211448473495534 Apr 18 at 8:59
  • I installed docker-ce, as mentioned in official docker docs. I still don't get the dockerd-current process. I tried in another CentOS setup, and it also has only dockerd process. I think both dockerd and dockerd-current process are same. – Akhil Mohan Apr 18 at 9:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.