Docker loading kernel modules

18
votes

I tried to install a kernel module, xfsprogs. It was successfully installed inside a container. It is really surprising, but lsmod doesn't list this module inside container or in the host system. How can a new kernel module loaded in a container?(CentOS container, Ubuntu host)

3
dockerkernelkernel-module
xfsprogs is a package, provided user-space libraries. lsmod shows kernel modules, currently loaded into kernel. - Tsyvarev
But then what is the necessary module for xfs fs. "support"? - user4725754
For make system able to mount filesystems formatted with xfs, you need to build kernel with xfs module enabled (in the configuration file). If sudo modprobe xfs (running on host machine) reports error that module is not found, then your kernel has no support for xfs filesystem. - Tsyvarev
I see, but how can I fix it(disabled xfs module) on host machine? - user4725754
The only clean way to enable xfs module in the kernel is rebuilding kernel(from Docker's kernel sources) with configuration file contained CONFIG_XFS_FS := m. If this way is inaccessible for some reason.. the other ways are just hacks, and are not simple ones. - Tsyvarev

3 Answers

25
votes
  • Run the container in privileged mode (--privileged)
  • Add all capabilities (--cap-add=ALL)
  • mount host /lib/modules into the container (-v /lib/modules:/lib/modules)
docker run --name container_name --privileged --cap-add=ALL -d \
       -v /dev:/dev -v /lib/modules:/lib/modules image_id

Caution: Here all Linux capabilities are added so capabilities can be refined.

19
votes

Containers interact with the kernel through system calls and don't include any part of the kernel or the kernel modules inside the container. This is one of the reasons why containers designed to be light weight and portable. Also xfsprogs are user space programs and not kernel modules.

How can a new kernel module loaded in a container?(CentOS container, Ubuntu host)

The module needs to be loaded on your host OS, and not from the docker container.

3
votes

Falco is an example of a container that loads a kernel module as part of its start process.

docker run -i -t --name falco --privileged \
  -v /var/run/docker.sock:/host/var/run/docker.sock \
  -v /dev:/host/dev \
  -v /proc:/host/proc:ro \
  -v /boot:/host/boot:ro \
  -v /lib/modules:/host/lib/modules:ro \
  -v /usr:/host/usr:ro \
  sysdig/falco