In this lesson, you will learn how to bypass the limitations of isolated container filesystems by securely mapping host directories into a container’s namespace using bind mounts.
Bridging the Namespace Gap
While Union Mounts and OverlayFS (which we covered in previous lessons) are perfect for creating immutable, layered images, they don’t help when you need a container to process live data residing on your host machine. This is where Bind Mounts come in. A bind mount takes an existing directory tree on your host and "re-attaches" it at a new point within a container's mount namespace.
Crucially, this is not a copy operation. The kernel maps the inode references from the host directory directly into the container’s filesystem tree. Because the container is running within a restricted namespace, it views this host directory as if it were a local subdirectory, maintaining the illusion of a self-contained environment.
Kernel-Level Isolation
Even though the container sees the files, the host's kernel-level isolation persists. If you have already applied Device Cgroups or Seccomp filters, those restrictions remain active even when the container accesses the bind-mounted path. The container can only perform operations on the mounted directory that the current process's Capabilities and Seccomp profile permit.
For example, you can expose a host configuration directory to a container in read-only mode, ensuring the containerized application can read the data without the ability to modify host files:
# Mounting a host directory into a namespace
mount --bind /host/data /container/root/mnt/data
# Marking it read-only for extra security
mount -o remount,ro,bind /container/root/mnt/data
This mechanism allows you to maintain "stateless" containers while still facilitating stateful operations. You aren't breaking out of the jail; you are simply extending the jail's view to include a specific, controlled sliver of the host's storage. By combining bind mounts with restricted process capabilities, you ensure that the shared data does not become a vector for privilege escalation or unauthorized system modification.
Key Takeaway: Bind mounts provide a surgical way to share host filesystem resources with isolated processes by re-mapping host inodes into the container’s mount namespace, while preserving the integrity of existing security boundaries.