Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[FEAT] Add Docker tmpfs Mount #1275

Open
flikites opened this issue Apr 13, 2024 · 1 comment
Open

[FEAT] Add Docker tmpfs Mount #1275

flikites opened this issue Apr 13, 2024 · 1 comment
Assignees
Labels
enhancement New feature or request

Comments

@flikites
Copy link
Contributor

flikites commented Apr 13, 2024

Is your feature request related to a problem? Please describe.

I get frustrated when I know a node operator or Flux administrator can snoop on my files in a container, easily.

This feature is useful to temporarily store sensitive files that you don't want to persist in either the host or the container writable layer. - (Taken directly from the Docker tmpfs mounts page)

Describe the solution you'd like

Their are two options that you can choose from to implement.

You can find them here: https://docs.docker.com/storage/tmpfs/#use-a-tmpfs-mount-in-a-container

Describe alternatives you've considered

Their aren't really any viable alternatives being that FluxOS control how a container is started.

@flikites flikites added the enhancement New feature or request label Apr 13, 2024
@flikites
Copy link
Contributor Author

flikites commented Apr 14, 2024

The solution I provided above would allow a user to create their app in a way that only would use the temporary RAMDISK directory that would be constructed as a result of starting the Docker container with either of those flags specified in the link I gave you.

Another option that I tested today that eliminates the ability to access any of the docker containers from a disk and only store those files in RAM is to run this command: mount -t tmpfs -o size=1024m tmpfs /var/lib/docker

The size parameter would need to specified accordingly. Though not sure how it would be able to be implemented in Flux

EDIT: This seems to be very interesting and would (I think) accomplish the same type of behavior.

(First Comment)
moby/moby#41110

(Edits that were made to accomplish)
moby/moby@master...Jongy:moby:overlayfs-upperdir-tmpfs

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request
Projects
None yet
Development

No branches or pull requests

2 participants