3

When inspecting the filesystem of a docker container I used df -h to check filesystem from the point of view of the container:

$ docker run -it busybox sh 
/ # df -h
Filesystem                Size      Used Available Use% Mounted on
overlay                  97.8G     78.7G     14.1G  85% /
tmpfs                    64.0M         0     64.0M   0% /dev
tmpfs                     7.8G         0      7.8G   0% /sys/fs/cgroup
/dev/sda2                97.8G     78.7G     14.1G  85% /etc/resolv.conf
/dev/sda2                97.8G     78.7G     14.1G  85% /etc/hostname
/dev/sda2                97.8G     78.7G     14.1G  85% /etc/hosts
shm                      64.0M         0     64.0M   0% /dev/shm
tmpfs                    64.0M         0     64.0M   0% /proc/kcore
tmpfs                    64.0M         0     64.0M   0% /proc/timer_list
tmpfs                    64.0M         0     64.0M   0% /proc/sched_debug
tmpfs                     7.8G         0      7.8G   0% /proc/scsi
tmpfs                     7.8G         0      7.8G   0% /sys/firmware

What I see when I run df -h on my actual host is:

$ df -h
Filesystem      Size  Used Avail Use% Mounted on
udev            7.8G     0  7.8G   0% /dev
tmpfs           1.6G  9.6M  1.6G   1% /run
/dev/sda2        98G   79G   15G  85% /
tmpfs           7.8G   82M  7.8G   2% /dev/shm
tmpfs           5.0M  4.0K  5.0M   1% /run/lock
tmpfs           7.8G     0  7.8G   0% /sys/fs/cgroup
/dev/sda3       108G   34G   75G  31% /dev/sda5
/dev/sda1       511M   32M  480M   7% /boot/efi
tmpfs           1.6G   56K  1.6G   1% /run/user/1000

It is not surprising that there are extra other filesystems mounted in the container by docker engine, however, I did not expect the container to be able to see /dev/sda2 and it's usage. Can you explain such behaviour as I have not attached any volumes? I expected the container to have an isolated view of the host not to be able to "see" some of its filesystems.

  • I think, for the host, a container is one just process. Docker container is sharing complete OS binaries and putting container processes as an add-on layer. So as docker container as one process you are getting complete file system from container login. – Sunil Bhoi Jan 11 at 7:32
4

Your actual host has sda1, sda2, and sda3, while your docker instance only has sda2. They are also mounted differently. For your docker instance:

/dev/sda2                97.8G     78.7G     14.1G  85% /etc/resolv.conf
/dev/sda2                97.8G     78.7G     14.1G  85% /etc/hostname
/dev/sda2                97.8G     78.7G     14.1G  85% /etc/hosts

For your actual host:

/dev/sda1       511M   32M  480M   7% /boot/efi
/dev/sda2        98G   79G   15G  85% /
/dev/sda3       108G   34G   75G  31% /dev/sda5

EDIT:

Finally their usage values vary greatly. They are clearly different devices.

The usage values match for sda2. Perhaps this cannot be avoided. As far as I know, Doker wasn't created with multi-tenancy in mind (e.g. hosting services for third parties) but more in the lines of DevOps with the person maintaining the docker containers also having access to the physical host so I wouldn't see this as a huge problem.

  • Thanks for the answer. The problem is that I do not expect the container to know that I have used 85% of my /dev/sda2 on the actual host. I was surprised that the container even has access to /dev/sda2 metadata. But from a different viewpoint, why does it only see sda2 usage data and not the other two? What protocol determines that what part of the host filesystems is visible to the container. I could not find anything on the documentation. – Farzad Vertigo Jan 11 at 7:41
  • 2
    Docker isolates a process from other process on the host, but not from the host itself. This is a common misconception, because to make containers easy to use, various mechanisms are employed that make a container look like full blown virtualisation when it is anything but. This is why Docker is not suitable as a security isolation tool. – clockworknet Jan 11 at 14:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.