docker - 绑定(bind)挂载目录时 'rw'是什么意思

Question

启动容器并指定卷时，您可以选择附加第三个字段，该字段是逗号分隔的选项列表，如 rw .

docker run -v /some-host/path:/some-container/path:rw

相同的选项适用于 docker.compose.yml

services:
  myService:
    image: some/image
    volumes:
      - /some-host/path:/some-container/path:rw

我认为指定 rw这意味着容器将能够读取和写入该目录(无论用户如何)。与我的看法相反，当主机目录不存在时，docker 将其创建为 drwxr-xr-x 2 root root无论我指定什么。容器中的应用程序未在 root 上运行但是，它会尝试写入已安装的驱动器并获取 Permission denied .

我翻遍了 docker 文档，甚至发现了这个 github issue描述相同的问题，但找不到任何明确的解释预期行为的东西。

那么 rw 到底是什么？ (读/写)是指何时指定为绑定(bind)挂载目录的第三个选项？

Answer 1

正如 DavidMaze 在评论中所说

in the same way that / on your host is mounted read-write but isn’t world-writable on every file; if it were mounted read-only nobody could write any file.

和 docs :

If neither 'rw' or 'ro' is specified then the volume is mounted in read-write mode.

和

If you supply an absolute path for the host-dir, Docker bind-mounts to the path you specify.

目录是 “安装”默认为 rw。所以认为在目录中写入 rw 是不够的挂载，您还需要对其的文件权限。另一方面，如果目录以只读方式挂载，则拥有完整文件权限是不够的。将其视为两层权限。

Also :

There is clear value in the ability to make bind mounts read-only, though. Containers are one example: an administrator may wish to create a container in which processes may be running as root. It may be useful for that container to have access to filesystems on the host, but the container should not necessarily have write access to those filesystems.