Docker No volumes Plugin
In order to use this plugin you need to be running at least Docker 1.10 which has support for authorization plugins.
When a volume in provisioned via the
VOLUME instruction in a Dockerfile or via
docker run -v volumename, host's storage space is used. This could lead to an
unexpected out of space issue which could bring down everything.
There are situations where this is not an accepted behavior. PAAS, for instance,
can't allow their users to run their own images without the risk of filling the
entire storage space on a server. One solution to this is to deny users from running
images with volumes. This way the only storage a user gets can be limited and PAAS
can assign quota to it.
This plugin solves this issue by disallowing starting a container with local volumes defined.
In particular, the plugin will block
docker run with:
- images that have
- volumes early provisioned with
The only thing allowed will be just bind mounts.
$ export GOPATH=~ # optional if you already have this $ mkdir -p ~/src/github.com/projectatomic # optional, from now on I'm assuming GOPATH=~ $ cd ~/src/github.com/projectatomic && git clone https://github.com/projectatomic/docker-novolume-plugin $ cd docker-novolume-plugin $ make
$ sudo make install $ systemctl enable docker-novolume-plugin
--authorization-plugin=docker-novolume-plugin in the
docker daemon command line
flags (either in the systemd unit file or in
or when manually starting the daemon).
The plugin must be started before
docker. This is done automatically via systemd unit file on boot, or you can start it manually with:
$ systemctl start docker-novolume-plugin
If you're not using the systemd unit, it can be started with:
$ docker-novolume-plugin &
docker and you're good to go!
Systemd socket activation
The plugin can be socket activated by systemd. You just have to basically use the file provided
systemd/ (or installing via
make install). This ensures the plugin gets activated
if for some reasons it's down.
How to test
$ sudo dnf install docker-novolume-plugin $ sudo systemctl start docker-novolume-plugin # edit /etc/sysconfig/docker and append --authorization-plugin=docker-novolume-plugin to OPTIONS $ sudo systemctl restart docker $ docker run -v /:/test fedora sh # works $ docker run -v /test fedora sh # blocked $ docker volume create --name test $ docker run -v test:/test fedora sh # blocked $ docker build -t testimage - <<EOF FROM fedora VOLUME foo EOF $ docker run testimage sh # blocked
Docker 1.11 will come with an Authentication infrastructure. Authorization plugins like
this one can leverage Authentication receiving the
username|group of the user actually
doing the action in order to take more fine grained decisions.
We basically want to allow a particular user, say
dwalsh, or group to run containers with
volumes while blocking everyone else. We'll bring this behavior introducing
a configuration file under
the following syntax (for the example above):
[docker-novolume-plugin] allow-user = ["dwalsh"] allow-group =