{"action":"created","issue":{"url":"https://api.github.com/repos/docker/docker/issues/16429","labels_url":"https://api.github.com/repos/docker/docker/issues/16429/labels{/name}","comments_url":"https://api.github.com/repos/docker/docker/issues/16429/comments","events_url":"https://api.github.com/repos/docker/docker/issues/16429/events","html_url":"https://github.com/docker/docker/issues/16429","id":107364001,"number":16429,"title":"Unable to mount within a container even w/ `--cap-add=SYS_ADMIN`","user":{"login":"dalanlan","id":5979704,"avatar_url":"https://avatars.githubusercontent.com/u/5979704?v=3","gravatar_id":"","url":"https://api.github.com/users/dalanlan","html_url":"https://github.com/dalanlan","followers_url":"https://api.github.com/users/dalanlan/followers","following_url":"https://api.github.com/users/dalanlan/following{/other_user}","gists_url":"https://api.github.com/users/dalanlan/gists{/gist_id}","starred_url":"https://api.github.com/users/dalanlan/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dalanlan/subscriptions","organizations_url":"https://api.github.com/users/dalanlan/orgs","repos_url":"https://api.github.com/users/dalanlan/repos","events_url":"https://api.github.com/users/dalanlan/events{/privacy}","received_events_url":"https://api.github.com/users/dalanlan/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/docker/docker/labels/area/security/apparmor","name":"area/security/apparmor","color":"fbca04"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":12,"created_at":"2015-09-20T00:20:47Z","updated_at":"2015-09-30T22:23:58Z","closed_at":null,"body":"According to [docke run reference](https://docs.docker.com/reference/run/) #Runtime privilege, Linux capabilities, and LXC configuration session, it should enable mount syscall w/ `--cap-add=SYS_ADMIN`.\r\nThis is also confirmed by someone who opened #9950 with docker 1.5. \r\nYet it doesn't work for me now. Is this expected?\r\n\r\n####How to reproduce\r\n```\r\n$ docker run --cap-add=SYS_ADMIN -it ubuntu /bin/bash\r\nroot@1a6c069a8589:/# cd home/\r\nroot@1a6c069a8589:/home# mkdir 1\r\nroot@1a6c069a8589:/home# mkdir 2\r\nroot@1a6c069a8589:/home# mount --bind 1 2\r\nmount: block device /home/1 is write-protected, mounting read-only\r\nmount: cannot mount block device /home/1 read-only\r\nroot@1a6c069a8589:/home# exit\r\n$ docker run --cap-add=ALL -it ubuntu /bin/bash\r\nroot@1e04bcd81fee:/# cd home/\r\nroot@1e04bcd81fee:/home# mkdir 1\r\nroot@1e04bcd81fee:/home# mkdir 2\r\nroot@1e04bcd81fee:/home# mount --bind 1 2\r\nmount: block device /home/1 is write-protected, mounting read-only\r\nmount: cannot mount block device /home/1 read-only\r\nroot@1e04bcd81fee:/home# exit\r\n```\r\n`--privileged` is all right though. FYI.\r\n####ENV \r\ndocker version: 1.7.1\r\nplatform: ubuntu 12.04\r\n\r\n/cc @cpuguy83  "},"comment":{"url":"https://api.github.com/repos/docker/docker/issues/comments/144561217","html_url":"https://github.com/docker/docker/issues/16429#issuecomment-144561217","issue_url":"https://api.github.com/repos/docker/docker/issues/16429","id":144561217,"user":{"login":"cpuguy83","id":799078,"avatar_url":"https://avatars.githubusercontent.com/u/799078?v=3","gravatar_id":"","url":"https://api.github.com/users/cpuguy83","html_url":"https://github.com/cpuguy83","followers_url":"https://api.github.com/users/cpuguy83/followers","following_url":"https://api.github.com/users/cpuguy83/following{/other_user}","gists_url":"https://api.github.com/users/cpuguy83/gists{/gist_id}","starred_url":"https://api.github.com/users/cpuguy83/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/cpuguy83/subscriptions","organizations_url":"https://api.github.com/users/cpuguy83/orgs","repos_url":"https://api.github.com/users/cpuguy83/repos","events_url":"https://api.github.com/users/cpuguy83/events{/privacy}","received_events_url":"https://api.github.com/users/cpuguy83/received_events","type":"User","site_admin":false},"created_at":"2015-09-30T22:23:58Z","updated_at":"2015-09-30T22:23:58Z","body":"The expected behavior here is that if a user has CAP_SYS_ADMIN then that user should be able to mount."}}