How to use setfacl within a Docker container?

Question

It seems like within the container the filesystem is mounted without 'acl', therefore 'setfacl' won't work. And it won't let me remount it either, and I can't even run 'df -h'.

I need setfacl because I make root own all the files from my websites, and I give the webserver user write permissions to only a few directories like cache, logs, etc.

What can I do?

Answer 1

The good news is that Docker supports ACLs.

In early releases Docker used a filesystem named AUFS which didn't support them. You could tell Docker to use Device Mapper (LVM) for its storage, by starting your Docker daemon with the appropriate option:

docker -d --storage-driver=devicemapper --daemon=true

Source: https://groups.google.com/forum/#!topic/docker-user/165AARba2Bk

and then you were able to use setfacl in your containers.

Any reasonably recent release or Docker now uses the overlay2 storage driver, which supports that out of the box. To check what is your storage driver:

docker info | grep Storage

df -h doesn't work for a different and unrelated reason : it relies on /etc/mtab, not present in your case. In your container, create a link from procfs, that will solve this problem:

ln -s /proc/mounts /etc/mtab