How can access rights to mount points in Docker containers be restricted or granted?

In Docker, to restrict or grant access rights to mount points (volumes, bind mounts), the following parameters are used when running a container:

1. File system permissions

   • Permissions inside the container depend on the host permissions and the user under which the process in the container is running.
   • You can manage the UID/GID of the user in the container to restrict access to mounted folders.

2. Mount options

   • :ro — mount in "read-only" mode.
   • :rw — mount with read and write permissions (default).

Example:

docker run -v /host/path:/container/path:ro myimage

This gives the container read-only access to /container/path.

3. Using Docker Volume with drivers supporting access policies

   • Some volume drivers allow setting more granular permissions.

4. SELinux/AppArmor

   • On systems with SELinux or AppArmor, security policies can be configured to restrict container access to the filesystem.

5. Docker Compose

   • In docker-compose.yml, you can specify mount permissions:

   volumes:
     - type: bind
       source: ./data
       target: /app/data
       read_only: true
   

Thus, the main ways to restrict access to mount points are setting read-only mode and managing user permissions inside the container.