On Sun, Jan 18, 2015 at 08:50:35PM -0500, Colin Walters wrote: > On Sat, Jan 17, 2015, at 11:02 PM, Lars Kellogg-Stedman wrote: > > Hello all, > > > > With systemd 216 on Fedora 21 (kernel 3.17.8), I have run into an odd > > behavior concerning the PrivateTmp directive, and I am looking for > > help identifying this as: > > > > - Everything Is Working As Designed, Citizen > > - A bug in Docker (some mount flag is being set incorrectly?) > > This should be fixed by: > http://pkgs.fedoraproject.org/cgit/docker-io.git/commit/?id=6c9e373ee06cb1aee07d3cae426c46002663010d > > i.e. having docker.service use MountFlags=private, so its mounts > aren't visible to other processes.
Colin,
Thanks for the pointer.
It seems as if using MountFlags=private is going to cause a new set of
problems:
Imagine that I am a system administrator using Docker to containerize
services. I want to serve set up a webserver container on my Docker
host, so I mount the web content from a remote server:
mount my-fancy-server:/vol/content /content
And then expose that as a Docker volume:
docker run -v /content:/content webserver
This will fail mysteriously, because with MountFlags=private, the
mount of my-fancy-server:/vol/content on /content won't be visible to
Docker containers. I will spend fruitless hours trying to figure out
why such a seemingly simple operation is failing.
I think we actually want MountFlags=slave, which will permit mounts
from the global namespace to propagate into the service namespace
without permitting propagation in the other direction. It seems like
this would the Least Surprising behavior.
--
Lars Kellogg-Stedman <[email protected]> | larsks @ {freenode,twitter,github}
Cloud Engineering / OpenStack | http://blog.oddbit.com/
pgphEQ65s0FS9.pgp
Description: PGP signature
_______________________________________________ systemd-devel mailing list [email protected] http://lists.freedesktop.org/mailman/listinfo/systemd-devel
