[question] Is SYS_ADMIN / --privileged capabilities needed to run geesfes within docker / k8s?

[vadimkantorov]

Typically these are needed to run sudo mount, but are these needed for running mounting with geesefs?

I also wonder if --mount docker's cmdline argument could be used for creating geesefs mounts at container launch time?

Thanks!

[vitalif]

Yes, FUSE needs it either for geesefs itself or for the fusermount utility. As I understand, FUSE can be mounted by the root user in a user namespace, but this feature is only available since k8s 1.30 and not enabled by default: https://kubernetes.io/docs/tasks/configure-pod-container/user-namespaces/. --mount can't be used because, according to the man page, "current supported mount TYPES are bind, volume, and tmpfs".

[vadimkantorov]

Thanks! I think it would be very useful to mention these requirements and workarounds in the README, given that now more and more workloads are run inside docker / k8s and often without the admin capabilities...

[vadimkantorov]

Also, related discussions:

• Enable unprivileged FUSE mounts cloudfoundry/garden-runc-release#364
• Allow FUSE functionality by default docker/for-linux#321 (comment)

[vadimkantorov]

Also, there exists a project https://github.com/sholtrop/ldpfuse which tried on building a LD_PRELOAD'able library which transforms a FUSE-based file system into a LD_PRELOAD-based one. For many cases (and certainly for commands like ls/cat/find - I've experimented with these in https://github.com/vadimkantorov/libarchivepreload), it could be enough, I wonder if geesefs could be borrow its approach.

Then it could be a workaround for k8s/docker installs which do not allow for CSI plugin or user namespace stuff yet.

[vitalif]

https://github.com/jacobsa/fuse doesn't use a C library, it directly talks to the fuse kernel device. There's also another FUSE binding used for Windows version of geesefs, it is based on the FUSE C library indeed. But anyway LD_PRELOAD is a really ugly hack %)

[vadimkantorov]

For that second version, I wonder if geesefs can provide as a library C interface representing a state of virtual FS and low-level syscall/libc/posix-like functions for working with it? (like the interface in ldpfuse)

If so, a custom implementation of LD_PRELOAD bridge could be easily implemented by a user (or the functions could be used for working with s3 from the user's custom C code)