0

I'm trying to put a software inside a docker, and it tries to chown /sys/class/net/eth0

It's a proprietary code I can't control and I need to make it work inside docker.

When running it I see error logs like this:

{"error":"MySQL: Connection refused"}chown: changing ownership of ‘/sys/class/net/eth0’: Read-only file system

I want to fix this without giving write access to the docker. I want to keep the isolation that docker offers

4
  • 1
    If the goal is to get this software to work, and not to expose host network interfaces to a docker containers XY question, why not try a mount namespace where you can mount the real sysfs system somewhere else, mount a read-write filesystem on /sys (probably with a link farm, so stuff doesn't break), and then let your legacy software change ownership under /sys? If chown on /sys ever worked, it must have been a long time ago. No idea how well this would integrate with a run-of-the-mill docker container, though.
    – dirkt
    May 13 '19 at 8:34
  • Read up on namespaces (a Docker container is basically a bunch of namespaces set up in a certain way), create a mount namespace, start an xterm in it, try to unmount /sys and remount it, to, say, /sysfs, mkdir /sys and add symlinks until nothing obvious breaks, then try to run your program and see how it goes. I can't give a step-by-step description, sorry; I'd have to try this out myself. It's entirely possible it won't go smoothly and some things could need workarounds.
    – dirkt
    May 14 '19 at 6:37
  • I'm being an unhelpful pedant, but: The new version is not quite clear to me. I.e. it does not explicitly say whether you want the feature which operates on eth0 to perform some real operations or queries on the real eth0, or whether it's ok if it sees a dummy eth0 that does not really do anything.
    – sourcejedi
    May 15 '19 at 12:10
  • I want it to only be able to read stuff from eth0, but not change anything on it
    – Freedo
    May 16 '19 at 19:59
4

To run standard network monitoring software, you must use the --network host option in your docker run command. This will allow it to see all the same network devices.

If you need to actually capture packets, then you will also need to grant additional "capabilities" to the docker container. Otherwise you will get permission denied errors.

4
  • 1
    @Freedo I don't understand why it tries to chown files in /sys , I did not think that would work even outside of a container.
    – sourcejedi
    May 11 '19 at 14:51
  • I changed my question to avoid falling to the meta.stackexchange.com/questions/66377/what-is-the-xy-problem. I hope it's okay and thank for your answer!
    – Freedo
    May 15 '19 at 11:40
  • @Freedo I'll survive :-). (I don't think I spent too much time on this... Just to think about the options: if there was a good answer for a question that was not what you really wanted to ask, you could also ask a new question. Then I think you could vote to close your old question as "unclear" if necessary. I think "voting" to close your own question takes effect immediately. Answers on closed questions survive, unless the question is eventually deleted).
    – sourcejedi
    May 15 '19 at 12:09
  • @Freedo: my answer did not really engage with any attempt to write to /sys - I think you would also have to make sure SELinux / AppArmor didn't get in the way, and I didn't test it - so it wasn't entirely relevant. Or at least, my answer was already not relevant once the question had been updated to confirm the attempt to write to /sys by showing an error message.
    – sourcejedi
    May 15 '19 at 12:14
0

No need to allow permission in Dockerfile just add in docker run command --volume /sys:/sys:ro when you run image

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.