<p>How does a <strong>docker container</strong> <code>running on a docker machine instead of a k8s pod</code> operate the k8s cluster. For example, if i need to do something like this inside a container:</p>

<blockquote>
  <p>kubectl get pods</p>
</blockquote>

<p>In my dockerfile, I installed kubectl</p>

<pre><code>RUN curl -LO https://storage.googleapis.com/kubernetes-release/release/$(curl -s https://storage.googleapis.com/kubernetes-release/release/stable.txt)/bin/linux/amd64/kubectl
RUN chmod +x ./kubectl
RUN sudo mv ./kubectl /usr/local/bin/kubectl
</code></pre>

<p>when i run <code>kubectl get pods</code>, the result is as follows:</p>

<pre><code>kubectl get pod
error: no configuration has been provided, try setting KUBERNETES_MASTER environment variable
</code></pre>

<p>So I mounted the <code>config</code> into the docker container at <code>docker run</code>command</p>

<pre><code>docker run -v /root/.kube/config:/root/.kube/config my-images
</code></pre>

<p>the result is as follows:</p>

<pre><code>kubectl get pod
Error in configuration: 
* unable to read client-cert /root/.minikube/profiles/minikube/client.crt for minikube due to open /root/.minikube/profiles/minikube/client.crt: no such file or directory
* unable to read client-key /root/.minikube/profiles/minikube/client.key for minikube due to open /root/.minikube/profiles/minikube/client.key: no such file or directory
* unable to read certificate-authority /root/.minikube/ca.crt for minikube due to open /root/.minikube/ca.crt: no such file or directory
</code></pre>

<p>This seems to be due to the <code>current-context: minikube</code> in the k8s config file</p>

<p>Then mount the authentication file again, it run success.</p>

<p>Now, I can call the <code>kubectl get pods</code> command or <code>otherwise</code> manipulate a cluster outside the container when I mount <code>-v /root/.kube/config:/root/.kube/config -v /root/.minikube/:/root/.minikube/</code>, however, this <strong>does not apply to cluster mounts</strong> created by <code>kubeadm or otherwise</code>.</p>

<p>But I want to be able to <strong>mount the required configuration files and so on</strong> to the container in a <strong>uniform way</strong> so that I can use <strong>the same command</strong> to manipulate the k8s cluster, which may be created by <code>minikube</code> or <code>rancher k3s</code> or <code>kubeadm</code></p>

<p>In summary, I want to <strong>mount a uniform set of files or directories</strong> for all cases of the k8s cluster, such as <code>-v file: file -v dir:dir</code>, <strong>to implement</strong> operations on the k8s cluster <strong>created in any way</strong>, such as getting the pod status, creating, deleting various types of resources, and so on</p>

<blockquote>
  <p>I need to have the maximum permission to operate on k8s</p>
</blockquote>

<p>Can someone please tell me what is it that I need to do?</p>

<p>I think you can set the Docker user when running your container</p>

<p>You can run (in this example - ubuntu image) with an explicit user id and group id.</p>

<pre><code>$ docker run -it --rm \
  --mount "type=bind,src=$(pwd)/shared,dst=/opt/shared" \
  --workdir /opt/shared \
  --user "$(id -u):$(id -g)" \
  ubuntu bash

</code></pre>

<p>The difference is ‘–user “$(id -u):$(id -g)“’ - they tell the container to run with the current user id and group id which are obtained dynamically through bash command substitution by running the “id -u” and “id -g” and passing on their values.</p>

<p>This can be good enough already. The problem here is, that the user and group don’t really exist in the container. This approach works for the terminal command, but the session looks broken and you’ll see some ugly error messages like:</p>

<pre><code>"groups: cannot find name for group ID"
"I have no name!"
  - your container, complaining

</code></pre>

<p>While bash works, some apps might refuse to run if those configs look fishy.</p>

<p>Next you have to  configure and run your Docker containers correctly, so you don’t have to fight permission errors and access your files easily.</p>

<p>As you should create a non-root user in your Dockerfile in any case, this is a nice thing to do. You might as well set the user id and group id explicitly.</p>

<p>Below is a minimal Dockerfile which expects to receive build-time arguments, and creates a new user called “user”:</p>

<pre><code>FROM ubuntu

ARG USER_ID
ARG GROUP_ID

RUN addgroup --gid $GROUP_ID user
RUN adduser --disabled-password --gecos '' --uid $USER_ID --gid $GROUP_ID user
USER user

</code></pre>

<p>Take a look:  <a href="https://stackoverflow.com/questions/27701930/add-user-to-docker-container">add-user-to-container</a>.</p>

<p>You can use this Dockerfile, to build a fresh image with the host uid and gid. This image, needs to be built specifically for each machine it will run on to make sure everything is in order.</p>

<p>Then, you can run use this image for our command. The user id and group id are correct without having to specify them when running the container.</p>

<pre><code>$ docker build -t your-image \
  --build-arg USER_ID=$(id -u) \
  --build-arg GROUP_ID=$(id -g) .
$ docker run -it --rm \
  --mount "type=bind,src=$(pwd)/shared,dst=/opt/shared" \
  --workdir /opt/shared \
  your-image bash

</code></pre>

<p>There is no need to use “chown”, and you will get rid of annoying permission errors anymore.
Please take a look on this very interesting article: <a href="https://itnext.io/portable-kubernetes-management-with-kubectl-in-docker-cb861a2c3c02" rel="nofollow noreferrer">kubernetes-management-docker</a>, <a href="https://vsupalov.com/docker-shared-permissions/" rel="nofollow noreferrer">docker-shared-permissions</a>.</p>
