如何在 docker 容器内禁用 mount 命令

Question

如何避免在此 docker 会话结束时出现以下错误消息：

$ docker run -it ubuntu /bin/bash
root@b3bcdc4551f5:/# ls
bin  boot  dev  etc  home  lib  lib64  media  mnt  opt  proc  root  run  sbin  srv  sys  tmp  usr  var
root@b3bcdc4551f5:/# cd home/
root@b3bcdc4551f5:/home# ls
root@b3bcdc4551f5:/home# mkdir 1
root@b3bcdc4551f5:/home# mkdir 2
root@b3bcdc4551f5:/home# mount --bind 1 2
mount: block device /home/1 is write-protected, mounting read-only
mount: cannot mount block device /home/1 read-only

更新：

$ docker run --cap-add=SYS_ADMIN -it ubuntu /bin/bash
root@1a6c069a8589:/# cd home/
root@1a6c069a8589:/home# mkdir 1
root@1a6c069a8589:/home# mkdir 2
root@1a6c069a8589:/home# mount --bind 1 2
mount: block device /home/1 is write-protected, mounting read-only
mount: cannot mount block device /home/1 read-only
root@1a6c069a8589:/home# exit
$ docker run --cap-add=ALL -it ubuntu /bin/bash
root@1e04bcd81fee:/# cd home/
root@1e04bcd81fee:/home# mkdir 1
root@1e04bcd81fee:/home# mkdir 2
root@1e04bcd81fee:/home# mount --bind 1 2
mount: block device /home/1 is write-protected, mounting read-only
mount: cannot mount block device /home/1 read-only
root@1e04bcd81fee:/home# exit

--特权没关系。

Answer 1

自我回答:)
使用 '--security-opt apparmor:unconfined' 禁用 apparmor 会起作用。

参考：issue 16429

Answer 2

尝试遵循issue 9950中的建议：

除非您有 CAP_SYS_ADMIN，否则您无法调用 mount，这在默认容器配置中不可用。
你需要docker run --cap-add SYS_ADMIN