Question

如何在此泊坞窗会话结束时避免以下错误消息：

$ docker run -it ubuntu /bin/bash
root@b3bcdc4551f5:/# ls
bin  boot  dev  etc  home  lib  lib64  media  mnt  opt  proc  root  run  sbin  srv  sys  tmp  usr  var
root@b3bcdc4551f5:/# cd home/
root@b3bcdc4551f5:/home# ls
root@b3bcdc4551f5:/home# mkdir 1
root@b3bcdc4551f5:/home# mkdir 2
root@b3bcdc4551f5:/home# mount --bind 1 2
mount: block device /home/1 is write-protected, mounting read-only
mount: cannot mount block device /home/1 read-only

更新

$ docker run --cap-add=SYS_ADMIN -it ubuntu /bin/bash
root@1a6c069a8589:/# cd home/
root@1a6c069a8589:/home# mkdir 1
root@1a6c069a8589:/home# mkdir 2
root@1a6c069a8589:/home# mount --bind 1 2
mount: block device /home/1 is write-protected, mounting read-only
mount: cannot mount block device /home/1 read-only
root@1a6c069a8589:/home# exit
$ docker run --cap-add=ALL -it ubuntu /bin/bash
root@1e04bcd81fee:/# cd home/
root@1e04bcd81fee:/home# mkdir 1
root@1e04bcd81fee:/home# mkdir 2
root@1e04bcd81fee:/home# mount --bind 1 2
mount: block device /home/1 is write-protected, mounting read-only
mount: cannot mount block device /home/1 read-only
root@1e04bcd81fee:/home# exit

- 特权是可以的。

Answer 1

自我回答:)
使用＆＃39; --security-opt apparmor:unconfine d＆＃39;停用apparmor会工作的。

参考：issue 16429

Answer 2

尝试遵循issue 9950中的建议：

除非您有CAP_SYS_ADMIN，否则无法调用mount，这在默认容器配置中不可用。
您需要docker run --cap-add SYS_ADMIN

如何在docker容器中禁用mount命令

2 个答案: