5

What command line options can be used for enabling a tmpfs (temporary file system) inside a Docker container, that is rw (read/write) accessible and files on this fs (file system) are executable?

Example would be a shared memory tmpfs with 1GByte size, but standard flag is noexec

( shm on /dev/shm type tmpfs (rw,nosuid,nodev,noexec,relatime,size=1048576k) )

with:

docker -it --shm-size=1G alpine /bin/sh

2 Answers 2

14

You can pass mount parameters to the --tmpfs parameter, e.g. --tmpfs /mytmp:exec would allow execution of files.

$ docker run --rm -it --tmpfs /mytmp:exec ubuntu bash -c "mount | grep mytmp"
tmpfs on /mytmp type tmpfs (rw,nosuid,nodev,relatime)
2
  • Thx@all '\n'man docker-run '\n'--rm true|false '\n'Automatically remove the container when it exits. The default is false. '\n'--rm flag can work together with -d, and auto-removal will be done on daemon side. Note that it's incompatible with any restart policy other than none.
    – beyondtime
    Commented Feb 17, 2019 at 16:17
  • 4
    Thanks. It would be nice if docker people bothered to document their own software.
    – LtWorf
    Commented Apr 24, 2020 at 14:09
0

If you don't need namespace isolation, then you can use host IPC namespace (--ipc=host):

$ docker run --rm -it --ipc=host alpine sh -c 'mount | grep shm'
tmpfs on /dev/shm type tmpfs (rw,seclabel,nosuid,nodev)

vs

$ docker run --rm -it --shm-size=1G alpine sh -c 'mount | grep shm'
shm on /dev/shm type tmpfs (rw,seclabel,nosuid,nodev,noexec,relatime,size=1048576k)`
1
  • Thx@all '\n'At this point, for shared memory, namespace isolation (with shared kernel usage) seems more appropriate. '\n'man docker-run '\n'--ipc="" '\n'Sets the IPC mode for the container. The following values are accepted: '\n'(empty), private, sharable, container:name-or-ID, host '\n'If not specified is(empty), daemon default is used, which can either be private or shareable, depending on the daemon version and configuration.
    – beyondtime
    Commented Feb 17, 2019 at 16:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.