thealmightydrawingtablet/nfs-krb

it's an NFS server with kerberos integrated out of the box !

why?

because nobody else has made one for some reason ¯\_(ツ)_/¯

usage

sharing directory via env var

docker run -d --privileged -v /path/on/host:/container/srv \
 -e SHARED_DIRECTORY=/container/srv -e PERMITTED=10.0.0.0/8 \
 -e NFS_KRB_REALM=LOCALHOST.LOCAL -e KDC_MASTER_PASSWORD='unguessable!' \
 -e NFS_SERVER_FQDN=localhost.local -e NFS_CLIENT_FQDN=localhost  \
 -e NFS_V4_DOMAIN=localhost.local

bring your own /etc/exports

docker run -d --privileged -v /path/on/host:/container/srv/folder-1 -v /another/thing:/container/srv/folder-2 -v ./exports:/etc/exports.mnt \
 -e PERMITTED=10.0.0.0/8 \
 -e NFS_KRB_REALM=LOCALHOST.LOCAL -e KDC_MASTER_PASSWORD='unguessable!' \
 -e NFS_SERVER_FQDN=localhost.local -e NFS_CLIENT_FQDN=localhost  \
 -e NFS_V4_DOMAIN=localhost.local

recognized configuration environment variables

Variable	Default	Description
NFS_KRB_REALM	EXAMPLE.COM	Kerberos realm to authenticate with.
NFS_SERVER_FQDN	nfs-kerberos-server.default.svc.cluster.local	fully qualified domain name of the server. used in principal names. may be different from NFS_KRB_REALM.
NFS_CLIENT_FQDN	`nfs-kerberos-client.default.scc.cluster.local	fully qualified domain name of the client machine
NFS_V4_DOMAIN	default.svc.cluster.local	fully qualified domain name, as configured in the client's idmapd.conf. also used in the domain_realms section of krb5.conf
KDC_MASTER_PASSWORD	masterpw	kerberos database master password
RW_MODE	rw	controls NFS export read/write mode and the per-share option string.
SHARED_DIRECTORY	-	determines whether to configure a singular export.
PERMITTED	*	provides the allowed client list for a single exported directory.

---

CREDITS

• @andyzhangx for laying the groundwork for the v1 implementation check out his work here :D