标签：docker bind-mount
Bind mounts
自从Docker早期以来，绑定安装就一直在进行。与卷相比，绑定挂载的功能有限。当您使用绑定挂载时，主机上的一个文件或目录被安装到一个容器中。文件或目录由主机上的完整或相对路径引用。相比之下，在使用卷时，在主机上的Docker s存储目录中创建了一个新目录，Docker管理该目录的内容。
The file or directory does not need to exist on the Docker host already. It is created on demand if it does not yet exist. Bind mounts are very performant, but they rely on the host machine’s filesystem having a specific directory structure available. If you are developing new Docker applications, consider using named volumes instead. You can’t use Docker CLI commands to directly manage bind mounts.
Choosing the -v or –mount flag
Originally起初, the -v or --volume flag was used for standalone containers and the --mount flag was used for swarm services. However, starting with Docker 17.06, you can also use --mount with standalone containers. In general（通常来说）, --mount is more explicit and verbose. The biggest difference is that the -v syntax combines all the options together in one field, while the --mount syntax separates（分离） them. Here is a comparison of the syntax for each flag.
Tip: New users should use the --mount syntax. Experienced users may be more familiar with the -v or --volume syntax, but are encouraged to use --mount, because research has shown it to be easier to use.
-v or --volume: Consists of three fields, separated by colon characters (:). The fields must be in the correct order, and the meaning of each field is not immediately obvious.
In the case of bind mounts, the first field is the path to the file or directory on the host machine.
The second field is the path where the file or directory will be mounted in the container.
The third field is optional, and is a comma-separated list of options, such as ro, consistent, delegated, cached, z, and Z. These options are discussed below.
--mount: Consists of multiple key-value pairs, separated by commas and each consisting of a <key>=<value> tuple. The --mount syntax is more verbose than -v or --volume, but the order of the keys is not significant（意义，重要）, and the value of the flag is easier to understand.
The type of the mount, which can be bind, volume, or tmpfs. This topic discusses bind mounts, so the type will always be bind.
The source of the mount. For bind mounts, this is the path to the file or directory on the Docker daemon host. May be specified as source or src.
The destination（目的） takes as its value the path where the file or directory will be mounted in the container. May be specified as destination, dst, or target.
The readonly option, if present, causes the bind mount to be mounted into the container as read-only.
The bind-propagation option, if present, changes the bind propagation. May be one of rprivate, private, rshared, shared, rslave, slave.
The consistency option, if present, may be one of consistent, delegated, or cached. This setting only applies to Docker for Mac, and is ignored on all other platforms.
The --mount flag does not support z or Z options for modifying selinux labels.
Differences between -v and --mount behavior
Because the -v and --volume flags have been a part of Docker for a long time, their behavior cannot be changed. This means that there is one behavior that is different between -v and --mount.
If you use -v or --volume to bind-mount a file or directory that does not yet exist on the Docker host, -v will create the endpoint(终端) for you. It is always created as a directory.
If you use --mount to bind-mount a file or directory that does not yet exist on the Docker host, Docker does not automatically create it for you, but generates an error.
Start a container with a bind mount
The --mount and -v examples below produce the same result. You can’t run them both unless you remove the devtest container after running the first one.
--mount
docker run -d \
-it \
--name devtest \
--mount type=bind,source="$(pwd)"/target,target=/app \
nginx:latest
-v
$ docker run -d \
-it \
--name devtest \
-v "$(pwd)"/target:/app \
nginx:latest
Use docker inspect devtest to verify that the bind mount was created correctly. Look for the Mounts section:
"Mounts": [ { "Type": "bind",
"Source": "/tmp/source/target",
"Destination": "/app", "Mode": "",
.........
$ docker container stop devtest
$ docker container rm devtest
Mounting into a non-empty directory on the container
If you bind-mount into a non-empty directory on the container, the directory’s existing contents will be obscured（覆盖） by the bind mount. This can be beneficial（有益的）, such as when you want to test a new version of your application without building a new image. However, it can also be surprising and this behavior differs from that of docker volumes.
This example is contrived（考虑） to be extreme（极端的）, but will replace（替代） the contents of the container’s /usr/ directory with the /tmp/ directory on the host machine. In most cases, this would result in a non-functioning（非功能性的） container.
docker run -d \
-it \
--name broken-container \
--mount type=bind,source=/tmp,target=/usr \ tmp这个目录是本来存在的。 nginx:latest docker: Error response from daemon: oci runtime error: container_linux.go:262: starting container process caused "exec: \"nginx\": executable file not found in $PATH".
-v：
$ docker run -d \
-it \
--name broken-container \
-v /tmp:/usr \
nginx:latest
The container is created but does not start. Remove it:
$ docker container rm broken-container
Use a read-only bind mount
-v "$(pwd)"/target:/app:ro \
Configure the selinux label
如果您使用selinux，您可以添加z或z选项来修改将安装到容器中的主机文件或目录的selinux标签。这将影响主机本身的文件或目录，并可能在Docker的范围之外产生影响。
z选项表明绑定挂载内容是在多个容器之间共享的。
Z选项表明绑定挂载内容是私有的和未共享的。
使用这些选项时要特别小心。使用Z选项安装一个系统目录，如/home或/usr，将使您的主机不可操作，您可能需要手动将主机文件重新绑定。
本文出自 “11716212” 博客，请务必保留此出处http://11726212.blog.51cto.com/11716212/1975582
标签：docker bind-mount
原文地址：http://11726212.blog.51cto.com/11716212/1975582
