0

So, I am running a process inside a docker container. However, I don't want that process to be able to access any files outside the container. Can I safely assume that a process running inside the docker container can't see files outside the container, unless they are of course explicitly shared through the -v option.

2 Answers 2

1

Yes, the only way to access external files is with bind mounting them as volumes into the container.

If you don't mount the files / directories in the run command then the container will work with it’s internal resources i.e. packages that you have installed or files / directories copied into the container.

0

That depends on what you consider "completely".

By design, containers can only access host resources (files, network, processes etc.) through explicit sharing, -v in this case.

However, the container can tell what is its network bridge, and assume that that bridge is the container host. Then, if you're running some file sharing service like NFS or SMB, the container can try to connect to it.

Not the answer you're looking for? Browse other questions tagged or ask your own question.