Docker掛載主機(jī)目錄的時(shí)候世蔗，訪問(wèn)相應(yīng)的文件的時(shí)候端逼，會(huì)出現(xiàn)Premission denied的問(wèn)題。
[root@localhost soft]# docker images
REPOSITORY TAG IMAGE ID CREATED SIZE
docker.io/centos 7.2.1511 686672a1d0cc 5 weeks ago
//將主機(jī)上的/soft目錄掛載到docker的/soft目錄污淋，前面的是主機(jī)目錄顶滩，后面的是docker的目錄。
docker run -i -t -v /soft:/soft 686672a1d0cc /bin/bash
掛載后寸爆，查看相應(yīng)的文件出現(xiàn)如下的提示：
[root@ba471da26d07 soft]# ls
ls: cannot access jdk-8u102-linux-x64.tar.gz: Permission denied
hadoop-2.7.2.tar.gz jdk-8u102-linux-x64.tar.gz
問(wèn)題原因及解決辦法
原因是CentOS7中的安全模塊selinux把權(quán)限禁掉了礁鲁，至少有以下三種方式解決掛載的目錄沒(méi)有權(quán)限的問(wèn)題：
1.在運(yùn)行容器的時(shí)候，給容器加特權(quán)赁豆，及加上 --privileged=true 參數(shù)：
docker run -i -t -v /soft:/soft --privileged=true 686672a1d0cc /bin/bash
2.臨時(shí)關(guān)閉selinux：
setenforce 0
3.添加selinux規(guī)則仅醇，改變要掛載的目錄的安全性文本
更改安全性文本的格式如下
chcon [-R] [-t type] [-u user] [-r role] 文件或者目錄
選頃不參數(shù)：
-R ：連同該目錄下癿次目錄也同時(shí)修改；
-t ：后面接安全性本文的類(lèi)型字段歌憨！例如 httpd_sys_content_t 着憨；
-u ：后面接身份識(shí)別，例如 system_u务嫡；
-r ：后面街覘色甲抖，例如 system_r
[root@localhost Desktop]# chcon --help
Usage: chcon [OPTION]... CONTEXT FILE...
or: chcon [OPTION]... [-u USER] [-r ROLE] [-l RANGE] [-t TYPE] FILE...
or: chcon [OPTION]... --reference=RFILE FILE...
Change the SELinux security context of each FILE to CONTEXT.
With --reference, change the security context of each FILE to that of RFILE.
Mandatory arguments to long options are mandatory for short options too.
--dereference affect the referent of each symbolic link (this is
the default), rather than the symbolic link itself
-h, --no-dereference affect symbolic links instead of any referenced file
-u, --user=USER set user USER in the target security context
-r, --role=ROLE set role ROLE in the target security context
-t, --type=TYPE set type TYPE in the target security context
-l, --range=RANGE set range RANGE in the target security context
--no-preserve-root do not treat '/' specially (the default)
--preserve-root fail to operate recursively on '/'
--reference=RFILE use RFILE's security context rather than specifying
a CONTEXT value
-R, --recursive operate on files and directories recursively
-v, --verbose output a diagnostic for every file processed
The following options modify how a hierarchy is traversed when the -R
option is also specified. If more than one is specified, only the final
one takes effect.
-H if a command line argument is a symbolic link
to a directory, traverse it
-L traverse every symbolic link to a directory
encountered
-P do not traverse any symbolic links (default)
--help display this help and exit
--version output version information and exit
GNU coreutils online help: http://www.gnu.org/software/coreutils/
For complete documentation, run: info coreutils 'chcon invocation'
在主機(jī)中修改/soft目錄的安全性文檔
[root@localhost Desktop]# chcon -Rt svirt_sandbox_file_t /soft
[root@ba471da26d07 soft]# ll
total 384264
-rw-r--r--. 1 root root 212046774 Aug 8 10:01 hadoop-2.7.2.tar.gz
-rw-r--r--. 1 root root 181435897 Aug 8 09:23 jdk-8u102-linux-x64.tar.gz
做好上述的工作，在docker中就可以正常訪問(wèn)該目錄下的相關(guān)資源了心铃。
