Can an in-memory filesystem be created from inside a docker container with no special permissions?

Question

I'd like to create an in-memory filesystem within a docker container running on a cluster where I can't assign the container any special permissions (e.g. the container can't have CAP_SYS_ADMIN capability necessary for using mount).

Is it possible to create an in-memory filesystem under docker? Will one of the user space filesystems provide this functionality?

Reference article(s):

• User Space File Systems
• How do I mount --bind inside a Docker container?
• FUSE inside Docker
• An in-memory filesystem (ie, RAMDISK) using FUSE
• Riofs - fuse device not found

UPDATE: After finding and reading the references added above it's looking more and more like the answer is a firm no. I'll leave this open a bit in case anyone wants to elaborate or correct me.

Answer 1

Kubernetes can mount a ram disk for you. The answer is right there in the standard RTFM guide.

https://kubernetes.io/docs/concepts/storage/volumes/#emptydir

Create an emptyDir volume and set emptyDir.medium to "Memory" to build, what I interpret from the documentation to be, a dynamically sized memory file system which counts against the containers memory limit.

If you're not running under kubernetes, whatever system that deploys the docker container would need to create the ram disk and mount that into the container, or give the container the special permissions discussed in the various reference articles in the question.

Answer 2

This means that you can start a container where the /host directory is the / directory on your host; and the container can alter your host file system without any restriction. This is similar to how virtualization systems allow file system resource sharing.

Docker containers are very similar to LXC containers, and they have similar security features. When you start a container with docker run, behind the scenes Docker creates a set of namespaces and control groups for the container.