linux 为什么Docker会在用户匹配的情况下将卷挂载为root?

q3qa4bjr  于 2023-05-16  发布在  Linux
关注(0)|答案(1)|浏览(110)

容器内:

mark@L-R910LPKW:~$ docker run --rm -it -u 1000:1000 \
  -v /home/mark/.cache/go-build:/tmp/go-build-cache:delegated \
  argocd-test-tools:latest \
  bash -c "id ; ls -l /tmp/go-build-cache | head -2"

mark@L-R910LPKW:~$
uid=1000(user) gid=1000(user) groups=1000(user)
total 3356
drwxr-xr-x 2 root root 16384 May 11 16:05 00
mark@L-R910LPKW:~$

主机上:

mark@L-R910LPKW:~$ id ; ls -l /home/mark/.cache/go-build | head -2
uid=1000(mark) gid=1000(mark) groups=1000(mark),4(adm),20(dialout),24(cdrom),25(floppy),27(sudo),29(audio),30(dip),44(video),46(plugdev),117(netdev),1001(docker)
total 3356
drwxr-xr-x 2 mark mark 16384 May 11 12:05 00
mark@L-R910LPKW:~$

据我所知,docker应该以用户的身份挂载卷,因为uid匹配。
最后,我的docker是一个podman Package 器:

mark@L-R910LPKW:~$ which docker
/usr/bin/docker
mark@L-R910LPKW:~$ cat /usr/bin/docker
#!/bin/sh
[ -f /etc/containers/nodocker ] || \
echo "Emulate Docker CLI using podman. Create /etc/containers/nodocker to quiet msg." >&2
exec /usr/bin/podman "$@"
mark@L-R910LPKW:~$

我在Windows上运行WSL2。
怎么了?如何将卷挂载为uid 1000?

rjee0c15

rjee0c151#

在这里找到解决方案-https://github.com/containers/podman/issues/2898
原来有一个podman特定的标志--userns。当传递一个特殊值keep-id时,它修复了这个问题:

mark@L-R910LPKW:~$ docker run --rm -it -u 1000:1000 -v /home/mark/.cache/go-build:/tmp/go-build-cache:delegated --userns keep-id argocd-test-tools:latest bash -c "id ; ls -l /tmp/go-build-cache | head -2"
uid=1000(user) gid=1000(user) groups=1000(user)
total 3356
drwxr-xr-x 2 user user 16384 May 11 16:05 00
mark@L-R910LPKW:~$

相关问题