Skip to content

New devices on host are not exposed to privileged container #16160

@grepory

Description

@grepory

I have a very simple container, basically gliderlabs/alpine:3.2 with python running on a machine in AWS.

Inside that container, I have a script that attaches an EBS volume to the instance and then mounts it. To run the container I am using:

docker run --privileged -v /mnt:/mnt

I then run the script. It attaches the EBS volume to /dev/xvdc, but when it goes to mount the volume, /dev/xvdc isn't there.

subprocess.CalledProcessError: Command '['mount', '/dev/xvdc', '/mnt/nsqd-1']' returned non-zero exit status 255
bash-4.3# mount /dev/xvdc /mnt/nsqd-1
mount: mounting /dev/xvdc on /mnt/nsqd-1 failed: No such file or directory
bash-4.3# ls /mnt
nsqd-1

Outside the container, the device exists:

core@ip-172-31-8-49 ~ $ ls /dev/xvdc
/dev/xvdc

If a new device is exposed in /dev, I would expect to see it exposed to a running privileged container also.

core@ip-172-31-8-49 ~ $ docker version
Client version: 1.7.1
Client API version: 1.19
Go version (client): go1.4.2
Git commit (client): 2c2c52b-dirty
OS/Arch (client): linux/amd64
Server version: 1.7.1
Server API version: 1.19
Go version (server): go1.4.2
Git commit (server): 2c2c52b-dirty
OS/Arch (server): linux/amd64

core@ip-172-31-8-49 ~ $ docker info
Containers: 13
Images: 125
Storage Driver: overlay
 Backing Filesystem: extfs
Execution Driver: native-0.2
Logging Driver: json-file
Kernel Version: 4.1.6-coreos-r1
Operating System: CoreOS 766.3.0
CPUs: 1
Total Memory: 3.679 GiB
Name: ip-172-31-8-49.us-west-1.compute.internal
ID: WLDJ:3VZB:AARA:BILE:TLZK:ALOX:V7OY:UZB3:HPS6:QY3J:5ZIE:4XNA

core@ip-172-31-8-49 ~ $ uname -a
Linux ip-172-31-8-49.us-west-1.compute.internal 4.1.6-coreos-r1 #2 SMP Wed Sep 2 04:16:15 UTC 2015 x86_64 Intel(R) Xeon(R) CPU E5-2670 v2 @ 2.50GHz GenuineIntel GNU/Linux

Metadata

Metadata

Assignees

No one assigned

    Labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions