You will attach an ordinary host directory to a container and see who owns the files the container writes.
Instead of a volume name, -v can take a path to a host directory — this is a bind mount: -v /home/student/notes-host:/data. The path starts with /, ~ or ./ — that is how docker tells it from a volume name. The container sees the host directory as it is: what the process writes to /data shows up in the host directory at once, and the other way round.
Write a file from the container into a host directory
Run notes with the ~/notes-host directory in place of /data, create notes.txt from the container, look at the directory from the host and append a line to the file.
First, predict
You append a line to notes.txt from the host, as the student user. What will the shell answer?
Now start the exercise, run the command and compare your prediction with the output.
The kernel checks file permissions by numbers — the file owner's UID and the process's UID. The process in notes runs as root, UID 0, and the file it created belongs to root on the host as well. The rw-r--r-- mode gives others read access alone, so student cannot append to it.
It also works the other way: the process in a container runs as an ordinary user. Then it gets access to the host directory's files by the same permissions as any host user with that UID. How to run a container's process as another user is covered in the lesson on limits and the user in a container.