If you’re facing issues mounting an NFS share in unprivileged Linux containers, here are some workarounds and solutions that might help:
Solution 1: Use mount --bind with NFS Mount
Since unprivileged containers can’t directly mount NFS shares, you can mount the NFS share on the host system and then use a --bind mount to make the NFS mount accessible to the container.
Mount NFS on the Host: Run the following command on your Arch Linux host to mount the NFS share locally:
sudo mount -t nfs <server-ip>:/srv/nfs4/share1 /mnt/nfs4share
Bind Mount into the Container: Once the NFS share is mounted on the host, you can use --bind to make it available to the container.
If you have access to the container's configuration, bind mount it from /mnt/nfs4share to the desired path inside the container (e.g., /srv/nfs4/exports):
sudo mount --bind /mnt/nfs4share /path/to/container/root/srv/nfs4/exports
Restart Services: After configuring these bind mounts, you may need to restart the NFS service on the host to ensure everything is accessible.
Solution 2: Use unprivileged NFS Exports
If you control the NFS server’s export options, you may try adding specific permissions to allow unprivileged clients to access the NFS shares. In the NFS server’s /etc/exports file, modify the options for the shared directory:
/srv/nfs4/share1 <client-ip>(rw,sync,no_subtree_check,all_squash,anonuid=1000,anongid=1000)
- Explanation of Options:
all_squash: Maps all users (including root) to the anonymous user.anonuid=1000,anongid=1000: Sets the UID and GID for the anonymous user to match an unprivileged user on your system. Adjust 1000 to match the user ID on your client container.
After updating /etc/exports, run:
sudo exportfs -ra
Solution 3: Rootless Containers with fuse-overlayfs
For containers requiring filesystem operations like mounting, consider using a rootless container runtime with fuse-overlayfs, which might support filesystem mounts without requiring CAP_SYS_ADMIN.
Solution 4: Use a Different Protocol (e.g., SSHFS)
If NFS proves too restrictive for your use case with unprivileged containers, consider using SSHFS as an alternative. SSHFS works well for unprivileged users and doesn’t require mounting privileges. Here’s an example command:
sshfs <user>@<server-ip>:/srv/nfs4/share1 /path/to/container/root/srv/nfs4/exports -o allow_other
This would allow access to the share within the container without requiring root privileges on the container side.
Hopefully, these steps help address your NFS mount issues with unprivileged containers.
exportfson the server? What does logs show?exportfs -vshows the following/srv/nfs4/share <world>(sync,wdelay,hide,no_subtree_check,sec=sys,rw,secure,no_root_squash,no_all_squash)