<p>In my k8s pod, I want to give a container access to a S3 bucket, mounted with rclone.</p>
<p>Now, the container running rclone needs to run with <code>--privileged</code>, which is a problem for me, since my <code>main-container</code> will run user code which I have no control of and can be potentially harmful to my Pod.</p>
<p>The solution I’m trying now is to have a <code>sidecar-container</code> just for the task of running rclone, mounting S3 in a <code>/shared_storage</code> folder, and sharing this folder with the <code>main-container</code> through a Volume <code>shared-storage</code>. This is a simplified pod.yml file:</p>
<pre class="lang-yaml prettyprint-override"><code>apiVersion: v1
kind: Pod
metadata:
  name: two-containers
spec:
  restartPolicy: Never

  volumes:
    - name: shared-storage
      emptyDir: {}

  containers:
    - name: main-container
      image: busybox
      command: [&quot;sh&quot;, &quot;-c&quot;, &quot;sleep 1h&quot;]
      volumeMounts:
        - name: shared-storage
          mountPath: /shared_storage
          # mountPropagation: HostToContainer

    - name: sidecar-container
      image: mycustomsidecarimage
      securityContext:
        privileged: true
      command: [&quot;/bin/bash&quot;]
      args: [&quot;-c&quot;, &quot;python mount_source.py&quot;]
      env:
        - name: credentials
          value: XXXXXXXXXXX
      volumeMounts:
        - name: shared-storage
          mountPath: /shared_storage
          mountPropagation: Bidirectional
</code></pre>
<p>The pod runs fine and from <code>sidecar-container</code> I can read, create and delete files from my S3 bucket.<br />
But from <code>main-container</code> no files are listed inside of <code>shared_storage</code>. I can create files (if I set <code>readOnly: false</code>) but those do not appear in <code>sidecar-container</code>.</p>
<p>If I don’t run the rclone mount to that folder, the containers are able to share files again. So that tells me that is something about the rclone process not letting <code>main-container</code> read from it.</p>
<p>In <code>mount_source.py</code> I am running rclone with <code>--allow-other</code> and I have edit <code>etc/fuse.conf </code> as suggested <a href="https://github.com/rclone/rclone/issues/811#issuecomment-255599253" rel="nofollow noreferrer">here</a>.</p>
<p>Does anyone have an idea on how to solve this problem?</p>

Luiz Tauffer
<p>I've managed to make it work by using:</p>
<ul>
<li><code>mountPropagation: HostToContainer</code> on <code>main-container</code></li>
<li><code>mountPropagation: Bidirectional</code> on <code>sidecar-container</code></li>
</ul>
<p>I can control read/write permissions to specific mounts using <code>readOnly: true/false</code> on <code>main-container</code>. This is of course also possible to set within <code>rclone mount</code> command.</p>
<p>Now the <code>main-container</code> does not need to run in privileged mode and my users code can have access to their s3 buckets through those mount points!</p>
<p>Interestingly, it doesn't seem to work if I set <code>volumeMount:mountPath</code> to be a sub-folder of the rclone mounted path. So if I want to grant <code>main-container</code> different read/write permissions to different subpaths, I had to create a separate <code>rclone mount</code> for each sub-folder.</p>
<p>I'm not 100% sure if there's any extra security concerns with that approach though.</p>
