To illustrate this point, we will use an Alpine image with a volume. These two configurations will give us the ability to access files created by the container with a lower privileged user but also to avoid a container's user having root rights on our host. Map this user's sub UIDs with container's users.Tell Docker to use a different user than root.Since UID 0 is always root, the container's root will always match the host's root! This is the reason why, sometimes, we hear about ' Docker process isolation' or ' Process breaking out of a Docker container' because a user in a container has too many rights on the host. In a Docker context, container's users are mapped with host's users. This means that user foo will have access to files owned by users with a UID of 1000, 10. These two files have the same structure and are made of lines with this format: ::Įach line means that the user will gain access to a number of UID or GID starting from a certain number. Its configuration is made by editing two files: Doing this is a feature called “ User namespaces”.Ī user namespace extends user's rights by allowing it to access files owned by other users or groups. We have to map them into host's sub-users. Permission denied Translating users and groupsĪs every container can use a set of users and groups, we cannot just translate every container's user into a single host's user without breaking the rights. Now, from the host and with an unprivileged user, how can I access this file? Turns out I can't! $ echo 'foo' > test rw-r-r- 1 root root 0 Nov 14 15:53 /apps/files/testĪs you can see, inside the container, the file is owned by root. Replace and with any path that fits to you.ĭoing this, you are prompted inside an Alpine distribution and every file inside the host's directory will be available inside the container's directory, and vice versa.įrom the container, create a new file inside the volume: $ touch /apps/files/test Let's run an alpine container with a volume: $ docker run -it -v : alpine Then, from the container, we will create a new file inside the volume.įrom a host point of view, who will be the owner of this new file? What rights will be applied to it? We will bind a host directory to a volume making every file in this directory available inside the container. We will run an alpine container which is using root. In this first post, I will show how you can deal with file permissions when a container is using root and you want to keep access to the files as an unprivileged host user. Tips and reminders for using Docker daily.Set up a reverse proxy with Nginx and Docker-gen (Bonus: Let's Encrypt).This article is part of a series of three articles about Docker:

Docker volume permission