title: Volume that is encrypted and not accessible by host?
body: <p>I want a Docker container which has a storage volume which is inaccessible by the host machine.</p>
  
  <p>I have followed <a href="https://medium.com/@kalahari/docker-data-volume-snapshots-and-encryption-with-lvm-and-luks-ce80e0555225" rel="nofollow noreferrer">this guide</a>, which uses the <code>docker-lvm-plugin</code> plugin to mount a LUKS crypt volume. With some amendments to the approach I ended up doing this:</p>
  
  <pre class="lang-sh prettyprint-override"><code>apt install lvm2
  apt install xfsprogs
  pvcreate /dev/sdb
  vgcreate docker /dev/sdb
  lvcreate -L 15G -T docker/internal
  lvcreate -L 30G -T docker/volumes
  mkdir -p /var/run/key
  mount -t ramfs -o size=4M ramfs /var/run/key
  dd if=/dev/urandom of=/var/run/key/key.bin bs=1024 count=16
  apt install cryptsetup
  docker volume create --driver lvm --name cryptvol --opt size=100M --opt crypt=luks --opt keyfile=/var/run/key/key.bin
  docker run -d --name container -v cryptvol:/home alpine tail -f /dev/null
  </code></pre>
  
  <p>However I can then do this:</p>
  
  <pre class="lang-sh prettyprint-override"><code>$ docker exec -it container sh -c 'echo hello &gt; /home/hello.txt'
  $ # hello.txt is readable inside container
  $ docker exec -it container -c 'cat /home/hello.txt'
  hello
  $ # hello.txt ALSO readable outside container
  $ cat /var/lib/docker-lvm-plugin/cryptvol/hello.txt
  hello
  </code></pre>
  
  <p>It seems the contents of the crypt volume are visible to the host machine.</p>
  
  <p>Is it possible to have an encrypted volume inside a Docker container that is inaccessible by the host? </p>