Lab 13: Diagnose a bind-mount UID mismatch

Objective

Set up a bind-mount failure mode, then diagnose it using only the information available from inside the container and the host.

Tasks

Task 1: Create the volume

sudo mkdir -p /srv/uid-mismatch
sudo chown 1001:1001 /srv/uid-mismatch
sudo chmod 0755 /srv/uid-mismatch
ls -la /srv/uid-mismatch

Task 2: Start a container as a different UID

docker run -d --name uid-test -v /srv/uid-mismatch:/data alpine sleep 3600
docker exec uid-test id
# uid=0(root) gid=0(root)
docker exec uid-test touch /data/test
# This succeeds because the host directory is 0755 + owned by 1001.
# UID 0 on the host can read/write regardless.

Task 3: Reproduce the failure

Now use a non-root UID inside the container:

docker run -d --name uid-test2 -u 1001 -v /srv/uid-mismatch:/data alpine sleep 3600
docker exec uid-test2 id
# uid=1001
docker exec uid-test2 touch /data/test
# touch: /data/test: Permission denied

Task 4: Diagnose

docker exec uid-test2 ls -la /data
# total 0
# drwxr-xr-x 2 1001 1001 40 Aug  9 12:00 .
# drwxr-xr-x 6 root root  4096 Aug  9 12:00 ..

The directory is owned by UID 1001 with mode 0755 — no write permission for “others”.

docker exec uid-test2 cat /proc/self/status | grep ^Uid
# Uid: 1001 1001 1001 1001

The container’s UID is 1001; the host file is owned by 1001. Inside the container, the kernel sees the UID as 1001, not as root. The mode bits are checked against UID 1001 → only r-x allowed.

Task 5: Fix

Either:

# Option A: change ownership on the host to match the container's UID
sudo chown -R 1001:1001 /srv/uid-mismatch

# Option B: change the container's UID to match the host file
docker run -d --name uid-test-fixed -u 0 -v /srv/uid-mismatch:/data alpine sleep 3600
docker exec uid-test-fixed touch /data/test
# OK

# Option C: change the host file's mode to be world-writable
# (rarely appropriate; do not use in production)
sudo chmod 0777 /srv/uid-mismatch

Step 6: Verify the fix

docker exec uid-test2 touch /data/test && echo OK || echo FAIL

Cleanup

docker rm -f uid-test uid-test2 uid-test-fixed
sudo rm -rf /srv/uid-mismatch

Objectives

Prerequisites