xrdp with chanserv in a docker container without --privileged flag

[waldi5001]

I setup a small docker container and notice that no shared folder apear in thinclient_drives folder. After some research, I came to the conclusion that it must have something to do with FUSE. However, I have no idea at all about it in interaction with Docker. I read somewhere to solve the problem with the --privileged flag and actually with that, it works very well. In the research to "what the --privileged flag do", I came to the conclusion, that you don't want do that.

So here is my question: Can I get chanserv running without the --privileged flag?

Here is my running sample code:

docker run --rm -it --privileged --init -p 3389:3389 --name xrdp alpine sh

in the container, copy n' paste

apk add alpine-conf xrdp xorgxrdp mousepad
setup-desktop xfce

adduser -g testuser1 testuser1 << EOF
testuser1
testuser1
EOF

xrdp
xrdp-sesman

use the rdp client of your choice, config a shard host folder, login and look into /home/testuser1/thinclient_drives/

now, the same with docker run --rm -it --init -p 3389:3389 --name xrdp alpine sh

when I now try to reproduce the scenario and provide you logfiles, I cant't find something, sorry.

xrdp --version
xrdp 0.9.23.1

Hope you can help.

[matt335672]

Make sure /dev/fuse is available in your container.

We'll need the chansrv log file to look any further. It's normally in ~/.local/share/xrdp/xrdp-chansrv.${DNUM}.log where '$(DNUM}' is the display number.

[matt335672]

I have no idea I'm afraid - I don't use Docker.

I had a quick look on their repo though, and found docker/for-linux#321 which looks like your problem. It's currently unresolved and suggests you will need to use --privileged or --cap-add SYS_ADMIN to get FUSE working.

[waldi5001]

OK. So big thanks for your help. In my case --cap-add SYS_ADMIN doesn't help. Maybe there is another that help this post.

Can you type in some short explanations how xrdp mount the host folder? Use it fuse?

[matt335672]

It does use FUSE.

chansrv talks on an RDP virtual channel to the client using a protocol documented my Microsoft in [MS-RDPEFS]. From this it is able to query the client's remotely connected drives and create files for them in a FUSE filesystem.

chansrv runs as the logged-in user in the container (not root).

[waldi5001]

yesterday we're almost there. If you run the Container with these flags, it will work. I think this is the minimum config.

docker run --rm -it --device /dev/fuse --cap-add SYS_ADMIN --init -p 3389:3389 --name xrdp alpine sh

Should there be an entry in the "Drive redirection features" documentation?

[matt335672]

Maybe. Hopefully at some point docker/for-linux#321 will get fixed and this won't be necessary.