Host Path Safety Checks | Avoiding "invalid volume specification" | How to think about this?

[Lockszmith]

I've read through docker-nfs-bug.103994 thread, as well as Bluefin release notes and it's known-issues sections.

<rant>
I understand the reasoning behind the checks, however I do struggle with the choice of:
1. Allowing the validation check to be disabled system-wide
2. Deciding that bypassing the checks invalidates support.

I thought Host-Path was a solution that allows sharing data cross different components.
I understand ACLs need to match, and I understand constraints need to be met.
Otherwise what is the difference between Host-Path and PVC ?

With this state of mind, I was hoping that bypassing the checks would either be an app specific setting, or maybe a data-set specific setting.

I am also assuming that what is described in this thread will be patched to align with the test later on, and binding a Host Path that is under a share will be eventually disallowed.
</rant>

My question / why I'm posting:
With this understanding, what would be the best approach to share certain paths across components / apps / systems ?

One approach someone mentioned in the bug-thread, was to bind an NFS shares to the container, instead of a Host Path.
Is that the best approach? Isn't there a performance impact here? Especially for sharing between different apps?

I am hoping for a general discussion about strategies, however I do know some people prefer specifics, so in the following spoiler section I've listed some scenarios that I think are valid.

Show : Specific scenarios

Some scenarios I've thought of - where sharing directories across apps and SMB shares makes sense to me*

* Synchthing App: Allow access over SMB/NFS to the root dir where Syncthing stores a 'master copy' of files - mainly incoming pictures from a phone's camera.
* Download directory for a torrent client like Deluge or Jdownloader.

*This is by no way an exhaustive list of scenarios.

 

[MisterE2002]

I've read through docker-nfs-bug.103994 thread, as well as Bluefin release notes and it's known-issues sections.

<rant>
I understand the reasoning behind the checks, however I do struggle with the choice of:
2. Deciding that bypassing the checks invalidates support.

Invalidates support if they think it is related to your bug report. You still can create tickets.

I thought Host-Path was a solution that allows sharing data cross different components.
I understand ACLs need to match, and I understand constraints need to be met.
Otherwise what is the difference between Host-Path and PVC ?

Host-Path is a mapping. You can actually "see" the files on the host *and* in the container. AFAIK, that is all.

PVC is hidden, something like a blockdevice (zvol). It will be deleted if you delete a container. (not sure if that is really a smart move). You have to do steps to actually extract/import files outside of the container. The TrueCharts usually putting "/config" inside a PVC. So you have to do some manually steps to overrule this.

With this understanding, what would be the best approach to share certain paths across components / apps / systems ?

I also waiting for a best-pratices guide. But i just disabled the host-path check and i try to avoid PVC for the containers.

 

[Lockszmith]

Invalidates support if they think it is related to your bug report. You still can create tickets.

That may be true, but it puts the burden of proof on the entire system, instead of an app that might be behaving incorrectly.

PVC is basically a docker volume, so you're right that extracting the data requires 'some work' - but it's inherently 'safer', as 'messing it up by accident' is hard.
It feels to me that by treating the Host Path with those security checks - iX are treating Host Paths as if they are PVC - that's why I thought specific bypasses would make more sense.

Good point on the PVC going away when the service goes away. Host Path - will remain persistent.

Hope someone can come up with a clear guideline here.