Mounting directory writable in container?

[Lombra]

Hi,

I have a directory on the host that needs to be mounted as writable in an unprivileged container. I understand I can do UID mapping, but are there any other/better options? I would like it to be owned by www-data inside the container.

 

[fschauer]

Add the directory to the container via a bind mount:

pct set <vmid> -mp[n] /path/on/host,mp=/path/in/container,idmap=passthrough

Start the container and inside run chown www-data /path/in/container.

 

[Lombra]

That sounds like it would work well. Thanks! So it just maps the guest UID to the same host UID? Are there any non obvious security implications that I should keep in mind?

 

[fschauer]

So it just maps the guest UID to the same host UID?

Yes, only within that specific mount point.

Are there any non obvious security implications that I should keep in mind?

root inside the container also maps to root on the host for that mount. So don't bind-mount sensitive host system directories like /usr, /etc, ...

As an alternative, you can instead only map www-data to some host id. For example if www-data has UID/GID 33:

pct set <vmid> -mp[n] /path/on/host,mp=/path/in/container,idmap=u:33:33:1;g:33:33:1

Note that with this approach, you won't be able to run chown www-data /path/in/container from within the container. Instead set the ownership on the host with chown 33 /path/on/host