Linux加密卷并挂载docker上

Linux加密卷并挂载docker上

export PATH=$PATH:/sbin/

docker run --privileged --device /dev/sdb3 -itd --name as -p 5000:5000 mcr.microsoft.com/dotnet/sdk:6.0

创建加密分区

cryptsetup luksFormat /dev/sdb3

3、打开LUKS容器以使其可用

sudo cryptsetup open /dev/sdb3 myluksdisk

4、创建文件系统并挂载该磁盘

sudo mkfs.ext4 /dev/mapper/myluksdisk
sudo mkdir /mnt/myluksdisk
sudo mount /dev/mapper/myluksdisk /mnt/myluksdisk

5、进行读写操作并卸载磁盘

sudo touch /mnt/myluksdisk/test.txt
sudo umount -l /mnt/myluksdisk
sudo cryptsetup close myluksdisk

解密

创建之后利用设备挂载将该加密分区挂载到容器中，这里以创建一个debian为例

docker run --privileged --device /dev/sdb3 -itd  debian:latest

.net服务用下面的

docker run --privileged --device /dev/sdb3 -itd --name service -p 5000:5000 mcr.microsoft.com/dotnet/sdk:6.0

进入容器添加apt源

deb http://security.debian.org/debian-security buster/updates main 

更新源并且安装对应库文件和cryptsetup(期间需要手动输入1,27,1 )

apt update && apt install -y linux-image-$(uname -r)&& apt install -y cryptsetup

加载dm_mod模块

modprobe dm_mod

打开加密盘

cryptsetup open /dev/sdb3 myluksdisk

如果从文件读取可以

cryptsetup open --key-file password.txt /dev/sdb3 myluksdisk

创建文件系统并挂载该磁盘

//mkfs.ext4 /dev/mapper/myluksdisk
mkdir /mnt/myluksdisk
mount /dev/mapper/myluksdisk /mnt/myluksdisk

取消挂载和关闭磁盘

 umount -l /mnt/myluksdisk
 cryptsetup close myluksdisk