Device node ownership guarantees

This is perfectly normal. Basically, unprivileged containers can’t create device any devices nodes even harmless ones such as /dev/null, /dev/zero etc. which is why container runtimes bind-mount the host nodes into the container. But since host root isn’t mapped inside the container the owner is shown as nobody:nogroup. If you look at the output from findmnt inside the container you’ll see the bind-mounted devices:

| |-/dev/full                         udev[/full]                                    devtmpfs    rw,nosuid,noexec,relatime,size=8017608k,nr_inodes=2004402,mode=755
| |-/dev/null                         udev[/null]                                    devtmpfs    rw,nosuid,noexec,relatime,size=8017608k,nr_inodes=2004402,mode=755
| |-/dev/random                       udev[/random]                                  devtmpfs    rw,nosuid,noexec,relatime,size=8017608k,nr_inodes=2004402,mode=755
| |-/dev/tty                          udev[/tty]                                     devtmpfs    rw,nosuid,noexec,relatime,size=8017608k,nr_inodes=2004402,mode=755
| |-/dev/urandom                      udev[/urandom]                                 devtmpfs    rw,nosuid,noexec,relatime,size=8017608k,nr_inodes=2004402,mode=755
| |-/dev/zero                         udev[/zero]                                    devtmpfs    rw,nosuid,noexec,relatime,size=8017608k,nr_inodes=2004402,mode=755
| |-/dev/console                      devpts[/33]                                    devpts      rw,nosuid,noexec,relatime,gid=5,mode=620,ptmxmode=000
1 Like