Ttyjfyk

I would like people to access NFS shares from within Docker. Problem is inside of Docker they can become root, and then they can have write access to anyone's files by becoming that user. Is there a solution for this?

One possible solution would be to mount the NFS shares on the docker nodes instead of inside the containers. In this way, a container would only get access to a volume inside the share that you specify in your compose file, not the entire share itself. This is the approach im taking at my company, and it seems to work decently well for our small scale deployment. Another benefit to us is that it was easier to secure via stunnel since the number of servers mounting the share was substantially reduced.

If the user can get root in the container and can see the other users' files, there really isn't anything you can do to prevent them altering those files.

So you must prevent that happening: either limit what the container can "see" to the files it may be allowed to write, or prevent the container obtaining root.

Jason's suggestion is nice - limiting the containers "view" into the share so it can only access files it should be allowed to write.

However, if you want the container to be able to read other people's files, well you're going to have to prevent root.

Or get really familiar with SELinux, CGroups, and maybe other such granular controls.

I don't expect this is the answer you're hoping for. If someone gives you a way to do this, I would love to hear it.

You’d like an answer “drawing from credible and official source”, but the thing is that there can be several solutions, and the “best” one depends on the overall configuration in place and the amount of complexity that you’re willing to undergo to obtain the desired result.

Therefore you should describe at least an overview of your current setup, upon which we can try to provide a comprehensive answer.

Insofar, the most I can say, as a general idea, is that the first step is to mount the NFS shares from the Docker machine, not from the containers, and then distribute portions of that share to the respective containers via the usual methods available in Docker. This already may be not a simple task to do if you have a cluster of Docker machines hosting your containers.

Anyway, that is also not enough to avoid free access to the files in that portion by the root user of that container, and to achieve such finer control you need to configure ACLs (Access Control Lists), whether at the NFS level or at the server’s file-system level. For either of these two options you need to be the sysadmin of the NFS server, which has to have the notion (at least some notion) of the user-ids assigned to each user of each container. If not all user-ids, at least groups of them and then set up ACLs per group of users.

Look for NFS-acls (NFSv4 would be better) to learn what can be done at the NFS level (quite a lot), and POSIX-acls to learn about the file-system level. You may easily experiment this latter by using the setfacl and getfacl commands at the command prompt. To have these commands available you may need to install the relevant package of your operating system.

Have you looked at fuse mounting the NFS, in the host. When I use fuse to mount over ssh (sshfs). It is mounted as me, root does not get any special permissions on these files. (sudo is ineffective).