Bind Mounts, Read-Only Mounts, tmpfs, Mount Propagation, Subpaths, SELinux Labels, and Host Coupling: Diagnostics, Failure Modes, Security, and Performance

1. Evidence-first diagnostic sequence

2. Intentionally broken example: preserve the missing-source error

This is the same failure category as the Lesson 2 exercise, now treated diagnostically. The path is intentionally absent and stays inside the lab directory.

mkdir -p da21-diag/evidence
rm -rf da21-diag/not-present

set +e
docker run --rm   --mount type=bind,src="$(pwd)/da21-diag/not-present",dst=/data   busybox:1.36.1 ls /data   >da21-diag/evidence/stdout.txt 2>da21-diag/evidence/stderr.txt
status=$?
set -e

printf 'exit=%s
' "$status" | tee da21-diag/evidence/exit.txt
cat da21-diag/evidence/stderr.txt

docker context show | tee da21-diag/evidence/context.txt
docker context inspect "$(docker context show)" --format '{{json .Endpoints.docker.Host}}'   | tee da21-diag/evidence/endpoint.txt

test ! -e da21-diag/not-present && echo 'source remains absent'

The least-destructive correction is to create the intended source explicitly if it truly belongs on this daemon host, or fix the context/path if it does not. Switching to short syntax merely to suppress the error would erase useful evidence.

3. Remote context: client-local path is not remote-daemon state

A frequent mistake is running Docker from a laptop against a remote daemon and assuming ./config refers to the laptop. It does not. The remote daemon resolves the bind source. The secure alternatives are to place the required data on that host through an authorized deployment process, bake declared immutable data into the image, or use a storage/config mechanism designed for remote delivery.

4. Root-owned developer files

A container process running as UID 0 can create files in a writable bind that appear host-owned by root on native Linux. Preserve numeric ownership first. A common local-development correction is to run the container process as the developer's numeric UID/GID when the image supports it, rather than recursively changing broad host permissions.

# Native Linux diagnostic example; skip numeric ownership conclusions on Desktop if its sharing layer remaps IDs.
id
ls -ln da21-lab/host-rw 2>/dev/null || true

docker run --rm   --user "$(id -u):$(id -g)"   --mount type=bind,src="$(pwd)/da21-lab/host-rw",dst=/work   busybox:1.36.1 sh -c 'echo user-matched > /work/user-matched.txt'   2>da21-diag/evidence/user-write.err || true

ls -ln da21-lab/host-rw 2>/dev/null || true

If the application requires a specific in-image user, solve ownership as a deliberate image/runtime contract rather than falling back to world-writable permissions.

5. SELinux denial: keep the control, fix the label contract

On SELinux hosts, a bind may be blocked even when Unix permissions look correct. Capture getenforce and relevant audit evidence. Then choose the documented shared/private relabel option for the exact application directory if appropriate. Disabling SELinux converts a scoped labeling problem into a host-wide security regression.

6. Broad host mounts and Docker control interfaces

Giving an untrusted container access to host root or the Docker daemon control interface can effectively grant host-level authority. The remedy is architectural: remove that mount and expose only the specific data or API the workload truly needs. This course never uses those mounts as troubleshooting shortcuts.

7. Propagation surprises

If a nested host mount is not visible in a container, first inspect whether propagation is actually required and whether the host mount tree supports it. Do not jump from rprivate to rshared globally. On Docker Desktop, propagation does not work, so a Linux-only recipe is the wrong layer entirely.

8. Docker Desktop: correctness versus file-sharing performance

If a large source bind is slow on Desktop, prove the bottleneck before changing application behavior. Docker advises sharing only needed directories and using named volumes for database/cache data. Optional synchronized file sharing may help very large repositories, but mandatory course workflows remain free and use ordinary file sharing.

9. Unsafe shortcut → evidence-based correction

10. Exact cleanup

docker rm -f da21-ro da21-rw da21-inspect da21-tmpfs da21-prop-inspect 2>/dev/null || true
find da21-diag -maxdepth 2 -type f -print 2>/dev/null || true
# Review evidence, then remove only ./da21-diag and ./da21-lab when intentionally finished.

Knowledge check

Official references and version notes

• Docker Docs — Bind mounts — daemon-host paths, read-only mode, --mount versus -v, recursive mounts, propagation, and SELinux labeling.
• Docker Docs — tmpfs mounts — memory-backed lifetime, size/mode options, and cgroup memory accounting.
• Docker CLI — docker container run — mount and read-only-root-filesystem semantics.
• Compose Specification — service volumes — bind options, create_host_path, SELinux labels, tmpfs, and volume subpaths.
• Docker Docs — Volumes — volume-subpath as a mount-type-specific subpath feature and contrast with bind mounts.
• Docker Desktop — File sharing — host-to-VM sharing boundaries and performance guidance.
• Docker Desktop — Synchronized file shares — optional paid synchronized host-file caching for large repositories.
• Docker Engine 29 release notes — current Engine baseline and bind-create-src addition in 29.3.