1

Inside of an LXD container, I have created a disk image file and finally figured out how to mount it. However, a side effect of mounting the image makes it visible and readable to the host operating system.

Is there any way to mount this image inside of the container, but keep it private to the container?

Ubuntu 16.04.3 LTS (GNU/Linux 4.4.0-93-generic x86_64) lxd version 2.17

  • I don't know if that's in the direction you were thinking, but encryption can help you when you don't have full trust with your storage provider. Consider using, e.g., a LUKS file device. – Jonathan Y. Sep 6 '17 at 4:58
  • I have considered encryption, but I'm attempting to install a glusterfs node in the container, but I'm not sure gluster is going to appreciate the encrypted volume. Although, I haven't fully researched it. – TiberiusKirk Sep 6 '17 at 11:36
0

I could hide a mount by explicitly creating a new private mount namespace. First, I enabled loop devices and mounting as in this method.

$ lxc exec z1 touch foo
$ lxc exec z1 truncate -s 100M foo
$ lxc exec z1 mkfs.ext4 foo
mke2fs 1.43.4 (31-Jan-2017)
Discarding device blocks: done
Creating filesystem with 102400 1k blocks and 25688 inodes
Filesystem UUID: 79152d07-1b5e-4b60-b716-84e72a1cce50
Superblock backups stored on blocks:
    8193, 24577, 40961, 57345, 73729

Allocating group tables: done
Writing inode tables: done
Creating journal (4096 blocks): done
Writing superblocks and filesystem accounting information: done

$ lxc exec z1 mount foo /mnt
$ lxc exec z1 touch /mnt/foo

With this config, the mount point is not easily visible outside the container (it's not listed mount's output, for example). I had to access it using /proc/<pid-of-container-process>/cwd (which in turn was accessible only to root, but not to my regular user, who can run lxc commands):

$ grep /mnt /proc/*/mounts | head
/proc/13782/mounts:/dev/loop2 /mnt ext4 rw,relatime,data=ordered 0 0
/proc/13858/mounts:/dev/loop2 /mnt ext4 rw,relatime,data=ordered 0 0
/proc/14266/mounts:/dev/loop2 /mnt ext4 rw,relatime,data=ordered 0 0
/proc/14394/mounts:/dev/loop2 /mnt ext4 rw,relatime,data=ordered 0 0
/proc/14397/mounts:/dev/loop2 /mnt ext4 rw,relatime,data=ordered 0 0
/proc/14398/mounts:/dev/loop2 /mnt ext4 rw,relatime,data=ordered 0 0
/proc/14406/mounts:/dev/loop2 /mnt ext4 rw,relatime,data=ordered 0 0
/proc/14407/mounts:/dev/loop2 /mnt ext4 rw,relatime,data=ordered 0 0
/proc/14420/mounts:/dev/loop2 /mnt ext4 rw,relatime,data=ordered 0 0
/proc/14421/mounts:/dev/loop2 /mnt ext4 rw,relatime,data=ordered 0 0

$ ls /proc/14421/cwd/mnt
ls: cannot access '/proc/14421/cwd/mnt': Permission denied
$ sudo ls /proc/14421/cwd/mnt  # a process in the container
foo  lost+found

Now, making a private mount namespace using unshare:

$ lxc exec z1 bash
root@z1:~# umount /mnt
root@z1:~# unshare --mount -- /bin/bash
root@z1:~# mount --make-private foo /mnt
root@z1:~# ls /mnt
foo  lost+found
root@z1:~# exit
root@z1:~# ls /mnt
root@z1:~# exit

Now, these commands produced no output:

$ sudo ls /proc/14421/cwd/mnt
$ grep /mnt /proc/*/mounts | head

But now any processes in the container that need access to this mount point need to run in that mount namespace. This can done using nsenter, for example.

  • Thank you for taking the time with this issue. However it appears to not work as expected. While the mount point is private within the container, on the Ubuntu desktop the volume appears in the dock as /media/tk/95c3f396-9419-42df-aebc-d16e2038324a. It is not accessible to normal user, but root can easily read and write to the volume. – TiberiusKirk Sep 6 '17 at 11:26
  • @TiberiusKirk how did you setup the mount? – muru Sep 6 '17 at 11:27
  • Just as you showed in your answer, but specifically: mount --make-private -t xfs -o rw brick1.img /data/brick1 – TiberiusKirk Sep 6 '17 at 11:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.