{"action":"created","issue":{"url":"https://api.github.com/repos/docker/docker/issues/7054","labels_url":"https://api.github.com/repos/docker/docker/issues/7054/labels{/name}","comments_url":"https://api.github.com/repos/docker/docker/issues/7054/comments","events_url":"https://api.github.com/repos/docker/docker/issues/7054/events","html_url":"https://github.com/docker/docker/issues/7054","id":37983316,"number":7054,"title":"option to mount volumes noexec","user":{"login":"ibukanov","id":2381216,"avatar_url":"https://avatars.githubusercontent.com/u/2381216?v=3","gravatar_id":"","url":"https://api.github.com/users/ibukanov","html_url":"https://github.com/ibukanov","followers_url":"https://api.github.com/users/ibukanov/followers","following_url":"https://api.github.com/users/ibukanov/following{/other_user}","gists_url":"https://api.github.com/users/ibukanov/gists{/gist_id}","starred_url":"https://api.github.com/users/ibukanov/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ibukanov/subscriptions","organizations_url":"https://api.github.com/users/ibukanov/orgs","repos_url":"https://api.github.com/users/ibukanov/repos","events_url":"https://api.github.com/users/ibukanov/events{/privacy}","received_events_url":"https://api.github.com/users/ibukanov/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/docker/docker/labels/exp/expert","name":"exp/expert","color":"3B8686"},{"url":"https://api.github.com/repos/docker/docker/labels/kind/enhancement","name":"kind/enhancement","color":"E8CAAF"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":5,"created_at":"2014-07-16T13:47:30Z","updated_at":"2015-04-29T11:55:11Z","closed_at":null,"body":"For improved security it would be nice to have an option to mount volumes in the container with noexec flag, similar to the already supported read-only mounts. With noexec the application could not create a new executable by setting the executable permission on a file under its control in a volume. In turn this allows to restrict the application in the container to run only few selected executables.\r\n\r\nAFAICS the only way to do it currently is to bind-mount a host directory with noexec option and then pass it to the container with -v flag. However this requires to use non-portable host directories."},"comment":{"url":"https://api.github.com/repos/docker/docker/issues/comments/97400438","html_url":"https://github.com/docker/docker/issues/7054#issuecomment-97400438","issue_url":"https://api.github.com/repos/docker/docker/issues/7054","id":97400438,"user":{"login":"ibukanov","id":2381216,"avatar_url":"https://avatars.githubusercontent.com/u/2381216?v=3","gravatar_id":"","url":"https://api.github.com/users/ibukanov","html_url":"https://github.com/ibukanov","followers_url":"https://api.github.com/users/ibukanov/followers","following_url":"https://api.github.com/users/ibukanov/following{/other_user}","gists_url":"https://api.github.com/users/ibukanov/gists{/gist_id}","starred_url":"https://api.github.com/users/ibukanov/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ibukanov/subscriptions","organizations_url":"https://api.github.com/users/ibukanov/orgs","repos_url":"https://api.github.com/users/ibukanov/repos","events_url":"https://api.github.com/users/ibukanov/events{/privacy}","received_events_url":"https://api.github.com/users/ibukanov/received_events","type":"User","site_admin":false},"created_at":"2015-04-29T11:55:11Z","updated_at":"2015-04-29T11:55:11Z","body":"@ashwinphatak I suspect this is kernel and perhaps docker storage driver-dependent. On CoreOS with Linux 4.0 and docker 1.5 with overlayfs both your original example and a session with upper dir mount works:\r\n\r\n```\r\ncore@thip ~ $ sudo mkdir mnt test test/mnt-noexec\r\ncore@thip ~ $ sudo mount -o bind ./mnt ./tes/mnt-noexec/              \r\ncore@thip ~ $  sudo mount -o remount,noexec ./test/mnt-noexec/\r\ncore@thip ~ $ mount | grep mnt\r\n/dev/vda9 on /home/core/test/mnt-noexec type ext4 (rw,noexec,relatime,data=ordered)\r\ncore@thip ~ $ docker run -it --rm -v `pwd`/test:/test busybox\r\n/ # cp -a /bin/busybox /test/mnt-noexec/sh\r\n/ # ls -Rl /test\r\n/test:\r\ntotal 4\r\ndrwxr-xr-x    2 root     root          4096 Apr 29 11:40 mnt-noexec\r\n\r\n/test/mnt-noexec:\r\ntotal 552\r\n-rwsr-xr-x    1 root     root        561992 May 22  2014 sh\r\n/ # /test/mnt-noexec/sh -c 'echo 123'\r\n/bin/sh: /test/mnt-noexec/sh: Permission denied\r\n/ # mount | grep /test\r\n/dev/vda9 on /test type ext4 (rw,relatime,data=ordered)\r\n/dev/vda9 on /test/mnt-noexec type ext4 (rw,noexec,relatime,data=ordered)\r\n```\r\n\r\nThe reason that I used the upper dir was that I needed to expose few more directories into the container with different permissions."}}