Docker – Why is the Docker container unable to write to a mounted host directory

docker

I'm running a Docker container using the following command:

sudo docker run --name=bamboo-server -p 8085:8085 -p 54663:54663 -v /data/bamboo-server:/home/bamboo hwuethrich/bamboo-server

I want /home/bamboo in the container to be mapped to /data/bamboo-server. However, my container is unable to write to the mapped directory. This works fine from the host:

[walt@walt bamboo]$ touch /data/test.txt

But not from the container:

[walt@walt bamboo]$ sudo docker exec bamboo-server touch /home/bamboo/test.txt
touch: cannot touch '/home/bamboo/test.txt': Permission denied

The permissions of the /data directory are all chmodded to 777:

[walt@walt bamboo]$ ls -la /data/
total 0
drwxrwxrwx.  3 root root  43 May  6 02:29 .
dr-xr-xr-x. 18 root root 248 Apr 30 14:16 ..
drwxrwxrwx.  2 root root   6 May  6 01:50 bamboo-server
-rw-rw-r--.  1 walt walt   0 May  6 02:29 test.txt

[walt@walt bamboo]$ ls -la /data/bamboo-server/
total 0
drwxrwxrwx. 2 root root  6 May  6 01:50 .
drwxrwxrwx. 3 root root 43 May  6 02:29 ..

Other debugging info:

[walt@walt bamboo]$ sudo docker exec bamboo-server whoami
root

[walt@walt bamboo]$ sudo docker -v
Docker version 1.9.1, build ee06d03/1.9.1

[walt@walt bamboo]$ df -h /data
Filesystem      Size  Used Avail Use% Mounted on
/dev/sda1       1.9T   33M  1.9T   1% /data

Thanks!

Best Answer

You are using Docker on a system with SELinux installed and enforcing.

Under SELinux, files meant to be shared from host to container must be given the appropriate SELinux context, svirt_sandbox_file_t.

So you need to set up the appropriate file context:

semanage fcontext -a -t svirt_sandbox_file_t "/data(/.*)?"

And then reset the file contexts:

restorecon -r -v /data
Related Topic