Hello,

 

We have our NFS servers kerberized which requires a ticket to be able to access the NFS share. We also have a GPU cluster where people get to launch docker containers to complete work. Unfortunately, within the container users can’t access the NFS share even though its mapped on the host machine and in the container because they don’t have a ticket within the container.

 

So what are my options to deal with this? Would building a container and when it starts up, automatically enroll itself into FreeIPA be the best solution? As a test I tried to enroll the container in one of our test containers and freeipa-client-install complained that pid 1 wasn’t being ran by systemd, not quite sure how to get around that. However even if this was accomplished could enrolling 100s or 1000s of containers cause an issue for freeIPA?Most of these would be fairly short lived (few days to weeks). At that point I would need to go manually cleanup all of the enrolled machines.

 

The other and less optimal solution would be to use a non kerberized NFS share, pass through the uid/gid from the host, but with this solution users would know their own UID/GID in the container but wouldn’t know who owns what in the container because they would have nothing tell them in the container what UID/GID is associated with what account so it might get confusing.

 

I’m really just looking for any suggestions on what other people have done. I’m not even sure if what I’m doing is the right approach at all and I should be doing something totally different. Are there any other solutions/suggestions that people have used to operate with FreeIPA along with docker containers?


-Kevin