linux - 在Docker构建过程中使用mount命令

Question

因此，这是而不是关于寻求-v的解决方法。
我有一个Dockerfile，其目的是在容器内的/usr/local/<cross-compiler-path>和中安装交叉编译器。稍后在构建过程中，将文件安装到此交叉编译器，如下所示:root@5bee5daf8165:/# mount <blah.img.gz> /usr/local/<cross-compiler-path>我得到mount: /usr/local/<cross-compiler-path>: mount failed: Operation not permitted.尽管如果我跳过此步骤，完成构建，运行--privileged容器并安装，它可以正常工作。
我理解在构建中不提供特权模式的原因，因为它破坏了容器的“可移植性”，因为它们依赖于主机卷。但就我而言，我试图将其挂载在Container自己的文件系统中。为什么不允许这样做？
作为记录，我尝试将交叉编译器安装在其他路径上，如下所示:root@5bee5daf8165:/# mount <blah.img.gz> /home/<cross-compiler-path>但这也不起作用。我想尝试在Dockerfile中进行构建，并丢弃不再需要它们的构建缓存，这会使我的容器container肿。我有什么选择？

Answer 1

如Can You Mount a Volume While Building Your Docker Image to Cache Dependencies?的“Vladislav Supalov”中所述

Although there’s no functionality in Docker to have volumes at build-time, you can use multi-stage builds, benefit from Docker caching and save time by copying data from other images - be it multi-stage or tagged ones.

When building an image, you can’t mount a volume. However, you can copy (COPY) data from another image! By combining this, with a multi-stage build, you can pre-compute an expensive operation once, and re-use the resulting state as a starting point for future iterations.

例:

FROM ubuntu as intermediate
RUN apt-get install -yqq python-dev python-virtualenv
RUN virtualenv /venv/
RUN mkdir -p /src
# those don't change often
ADD code/basic-requirements.txt /src/basic-requirements.txt
RUN /venv/bin/pip install -r /src/basic-requirements.txt

FROM ubuntu
RUN apt-get install -yqq python-dev python-virtualenv
# the data comes from the above container
COPY --from=intermediate /venv /venv
ADD code/requirements.txt /src/requirements.txt
# this command, starts from an almost-finished state every time
RUN /venv/bin/pip install -r /app/requirements.txt

OP中添加注释:

I want to mount a volume internally to the container fs using the mount command while build, which currently doesn't work.

Just wanted to know if 'mount' operation, in general is tied to the kernel?

出于安全原因，不允许使用内核(不使用内核)直接使用mount(在受批准的卷之外) as described here和 BMitch。

Docker removes the mount privilege from containers because using this you could mount the host filesystem and escape the container.

如果确实需要在构建过程中挂载某些东西，则可以考虑使用 buildah ，而无需为每个层运行容器都可以进行构建(就像 docker build一样)，并且无需root就可以这样做。
使用 ONBUILD to read your existing Dockerfile 。
请注意，使用“ buildah mount ，您可以执行相反的操作:将指定容器的根文件系统挂载到可以从主机访问的位置，然后返回其位置。
那是另一种选择。