Incorrect behaviour with bind mounts outside of snap allowed paths

[charlesangus]

If you try to bind mount a path that's not on the list of paths snap allows external access to (e.g. /media, /home), it will appear to work, but in fact will not, and will exhibit some fairly perverse behaviour. You will appear to have created the bind mount successfully, you will appear to have persistent storage, but in fact, the files are going - somewhere. Not sure where, as find doesn't turn them up. Presumably on the snap's temp filesystem?

Repro steps:

sudo mkdir /mybind
sudo docker run -it -v /mybind:/mybind alpine /bin/sh
#root : touch /mybind/myuniquename
#root : exit
ls /mybind
<<there is no file>>
sudo docker run -it -v /mybind:/mybind alpine /bin/sh
#root: ls /mybind
myuniquename
#root: exit
sudo find / -name myuniquename
<<no output>>

[charlesangus]

Ideally, this would error out with some kind of error like Attempting to bind mount a path which snaps cannot access. Docker snap can only bind mount paths in <<list of allowed paths>>..

[priceaj]

+1

I've just spent a few hours trying to work out why my docker mounts pointing to /media were working but data in other volumes was disappearing when restarting the machine.

Using --volume to define a volume (or the equivalent syntax on compose) caused the directories to be created silently (I've now switched over to the --mount syntax but it didnt help with this issue as I still would not have been able to easily work out why docker couldnt see my created directory)

Portainer in host mode can "see" the newly created directories in / and the docker container has no problem with using them. Like the OP I also tried to use find to find to try to work out where these things went. I guess there is some kind of snap virtual file system??

Its not easy to work out what has gone wrong here, on the surface everything looks fine. I was previously using the apt version of docker, and the same compose files were working with no issue. I believe the snap version of docker was installed during the OOBE when reinstalling ubuntu server.

For anyone who finds this, the list of allowed directories are in here: https://github.com/canonical/snapd/blob/master/cmd/snap-confine/mount-support.c

I ended up moving my stuff into my home directory which worked correctly.

[AndreasHoffmann2]

I just lost almost 2 hours to this as well. I just wanted to do some quick tests with a certain docker-container in a quickly installed Ubuntu-VM.
But somehow, the files that should have been created by the image did not appear.
I followed several troubleshooting guides and checked the logs for error messages. And after nothing worked, I did everything again, just to be sure.
Guess my astonishment, when learning that snap just silently wrote the files to some invisible location. This is just mean IMO.