0

I'm trying to put a software inside a docker, and it tries to chown /sys/class/net/eth0

It's a proprietary code I can't control and I need to make it work inside docker.

When running it I see error logs like this:

{"error":"MySQL: Connection refused"}chown: changing ownership of ‘/sys/class/net/eth0’: Read-only file system

I want to fix this without giving write access to the docker. I want to keep the isolation that docker offers

  • 1
    If the goal is to get this software to work, and not to expose host network interfaces to a docker containers XY question, why not try a mount namespace where you can mount the real sysfs system somewhere else, mount a read-write filesystem on /sys (probably with a link farm, so stuff doesn't break), and then let your legacy software change ownership under /sys? If chown on /sys ever worked, it must have been a long time ago. No idea how well this would integrate with a run-of-the-mill docker container, though. – dirkt May 13 at 8:34
  • Read up on namespaces (a Docker container is basically a bunch of namespaces set up in a certain way), create a mount namespace, start an xterm in it, try to unmount /sys and remount it, to, say, /sysfs, mkdir /sys and add symlinks until nothing obvious breaks, then try to run your program and see how it goes. I can't give a step-by-step description, sorry; I'd have to try this out myself. It's entirely possible it won't go smoothly and some things could need workarounds. – dirkt May 14 at 6:37
  • @dirk I'm even willing to pay if you can make it work for me, do you have another means of contact? and btw I edited my question to reflect my real issue! I hope it's okay – Freedo May 15 at 11:40
  • I'm being an unhelpful pedant, but: The new version is not quite clear to me. I.e. it does not explicitly say whether you want the feature which operates on eth0 to perform some real operations or queries on the real eth0, or whether it's ok if it sees a dummy eth0 that does not really do anything. – sourcejedi May 15 at 12:10
  • I want it to only be able to read stuff from eth0, but not change anything on it – Freedo May 16 at 19:59
4

To run standard network monitoring software, you must use the --network host option in your docker run command. This will allow it to see all the same network devices.

If you need to actually capture packets, then you will also need to grant additional "capabilities" to the docker container. Otherwise you will get permission denied errors.

  • 1
    @Freedo I don't understand why it tries to chown files in /sys , I did not think that would work even outside of a container. – sourcejedi May 11 at 14:51
  • I changed my question to avoid falling to the meta.stackexchange.com/questions/66377/what-is-the-xy-problem. I hope it's okay and thank for your answer! – Freedo May 15 at 11:40
  • @Freedo I'll survive :-). (I don't think I spent too much time on this... Just to think about the options: if there was a good answer for a question that was not what you really wanted to ask, you could also ask a new question. Then I think you could vote to close your old question as "unclear" if necessary. I think "voting" to close your own question takes effect immediately. Answers on closed questions survive, unless the question is eventually deleted). – sourcejedi May 15 at 12:09
  • @Freedo: my answer did not really engage with any attempt to write to /sys - I think you would also have to make sure SELinux / AppArmor didn't get in the way, and I didn't test it - so it wasn't entirely relevant. Or at least, my answer was already not relevant once the question had been updated to confirm the attempt to write to /sys by showing an error message. – sourcejedi May 15 at 12:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.