Skip to content

Commit 453fbd7

Browse files
authored
Iotedge Host Storage Documentation Update
Updating the docs per debugging session with @ancaantochi Fixing these things: - Documentation said that no special host permissions were needed for EdgeAgent since it runs as container admin, but that is not true on Linux and appears to not be true on Windows either (even though it is running as container admin we still need host permissions). - Supply an example of a way to successfully configure Windows host level permissions. @ancaantochi I think it would be nice if we could drill down more into the security setting, rather than applying a blanket rule for all `Authenticated Users`. But I took a look at the available principals and there doesn't seem to be a better obvious choice. The fact this worked for us seems to mean that EdgeAgent is an authenticated user that is not covered by the default rule. But I didn't see any other users in the choices available. What is your opinion here? Is this OK or should we attempt more to drill down into permissions?
1 parent 7eaa903 commit 453fbd7

File tree

1 file changed

+6
-2
lines changed

1 file changed

+6
-2
lines changed

articles/iot-edge/how-to-access-host-storage-from-module.md

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -71,14 +71,18 @@ Replace `<HostStoragePath>` and `<ModuleStoragePath>` with your host and module
7171

7272
For example, on a Linux system, `"Binds":["/etc/iotedge/storage/:/iotedge/storage/"]` means the directory **/etc/iotedge/storage** on your host system is mapped to the directory **/iotedge/storage/** in the container. On a Windows system, as another example, `"Binds":["C:\\temp:C:\\contemp"]` means the directory **C:\\temp** on your host system is mapped to the directory **C:\\contemp** in the container.
7373

74-
Additionally, on Linux devices, make sure that the user profile for your module has the required read, write, and execute permissions to the host system directory. Returning to the earlier example of enabling IoT Edge hub to store messages in your device's local storage, you need to grant permissions to its user profile, UID 1000. (The IoT Edge agent operates as root, so it doesn't need additional permissions.) There are several ways to manage directory permissions on Linux systems, including using `chown` to change the directory owner and then `chmod` to change the permissions, such as:
74+
You can find more details about create options from [docker docs](https://docs.docker.com/engine/api/v1.32/#operation/ContainerCreate).
75+
76+
## Host System Permissions
77+
On Linux devices, make sure that the user profile for your module has the required read, write, and execute permissions to the host system directory. Returning to the earlier example of enabling IoT Edge hub to store messages in your device's local storage, you need to grant permissions to its user profile, UID 1000. There are several ways to manage directory permissions on Linux systems, including using `chown` to change the directory owner and then `chmod` to change the permissions, such as:
7578

7679
```bash
7780
sudo chown 1000 <HostStoragePath>
7881
sudo chmod 700 <HostStoragePath>
7982
```
8083

81-
You can find more details about create options from [docker docs](https://docs.docker.com/engine/api/v1.32/#operation/ContainerCreate).
84+
On Windows devices, you will also need to configure permissions on the host system directory. This can be done via the File Explorer. You need to grant a principal permission for all `Authenticated Users` to have `Full Control`.
85+
8286

8387
## Encrypted data in module storage
8488

0 commit comments

Comments
 (0)