Mounting nfs shares inside docker container

Solution 1:

Starting from docker 17.06, you can mount NFS shares to the container directly when you run it, without the need of extra capabilities

export NFS_VOL_NAME=mynfs
export NFS_LOCAL_MNT=/mnt/mynfs
export NFS_SERVER=my.nfs.server.com
export NFS_SHARE=/my/server/path
export NFS_OPTS=vers=4,soft

docker run --mount \
  "src=$NFS_VOL_NAME,dst=$NFS_LOCAL_MNT,volume-opt=device=:$NFS_SHARE,\"volume-opt=o=addr=$NFS_SERVER,$NFS_OPTS\",type=volume,volume-driver=local,volume-opt=type=nfs" \
  busybox ls $NFS_LOCAL_MNT

Alternatively, you can create the volume before the container:

docker volume create \
  --driver local \
  --opt type=nfs \
  --opt o=addr=$NFS_SERVER,$NFS_OPTS \
  --opt device=:$NFS_SHARE \
  $NFS_VOL_NAME

docker run --rm -v $NFS_VOL_NAME:$NFS_LOCAL_MNT busybox ls $NFS_LOCAL_MNT

• Got the hint from https://github.com/moby/moby/issues/28809
• official docs from docker: https://docs.docker.com/storage/volumes/#create-a-service-which-creates-an-nfs-volume

Solution 2:

For using mount, you'll need the CAP_SYS_ADMIN capability, which is dropped by Docker when creating the container.

There are several solutions for this:

1. Start the container with the --cap-add sys_admin flag. This causes Docker to retain the CAP_SYS_ADMIN capability, which should allow you to mount a NFS share from within the container. This might be a security issue; do not do this in untrusted containers. [A previous version of this answer suggested using the --privileged=true to retain all capabilities, thanks to @earcam for the suggestion to use --cap-add instead].

2. Mount the NFS share on the host and pass it into the container as a host volume:

   you@host > mount server:/dir /path/to/mount/point
   you@host > docker run -v /path/to/mount/point:/path/to/mount/point
   

3. Use a Docker volume plugin (like the Netshare plugin) to directly mount the NFS share as a container volume:

   you@host > docker run \
     --volume-driver=nfs \
     -v server/dir:/path/to/mount/point \
     centos
   

Solution 3:

For the second option listed in the accepted answer, I'm not sure if you have actually tried to use the "docker run -v" command to pass a NFS share on the host to docker container as a volume. I have recently tried to do so, below is the info for the nfs share on host:

nfs-server:/path_to_mount on /path_dest type nfs

and then:

docker run -it -v /path_dest:/path_in_docker docker_name bash

But the docker daemon always reports below error:

docker: Error response from daemon: stat /path_dest: permission denied.

After many searches, I found that the error actually comes from docker daemon, which is running as "root". When docker runs a container with volume to mount, it will request docker daemon to mount it. The problem is, NFS server will handle "root" differently. By default, NFS server will map the "root" to "nobody", causing the error message: reference