When mounting a host directory into a container, which condition must be true for the container to write to the directory?

When mounting a host directory into a container, which condition must be true for the container to write to the directory?

• A. The container's running user must have permissions to write in the directory
• B. The host directory must be world-writable
• C. SELinux must be disabled
• D. The container must run as root

Answer: (A)

Access to a mounted host directory inside a container is controlled by Linux file permissions on the host, evaluated against the user the container process runs as. When you mount a host directory, the container process uses its own user ID (and group) to access that path. If that user has write permission on the directory on the host (the owner’s write bit, group write with the appropriate group membership, or world-writable), the container can create or modify files there. If not, writing is blocked, regardless of other settings. SELinux or AppArmor policies, or the exact UID mapping, can influence access, but they are not requirements for write permission—the fundamental rule is that the container’s running user must have write rights on the directory. The container does not have to run as root to write, provided the host path permissions permit it.

Access to a mounted host directory inside a container is controlled by Linux file permissions on the host, evaluated against the user the container process runs as. When you mount a host directory, the container process uses its own user ID (and group) to access that path. If that user has write permission on the directory on the host (the owner’s write bit, group write with the appropriate group membership, or world-writable), the container can create or modify files there. If not, writing is blocked, regardless of other settings.

SELinux or AppArmor policies, or the exact UID mapping, can influence access, but they are not requirements for write permission—the fundamental rule is that the container’s running user must have write rights on the directory. The container does not have to run as root to write, provided the host path permissions permit it.