Tweak docs on NFS and identity management

mkdocs/docs/faq/compatibility_and_integration.md

@@ -151,11 +151,13 @@ given the complication it introduces.
 
 ## Can mergerfs be used with NFS root squash?
 
-If mergerfs is pooling a NFS mount then root squash should be disabled
+If mergerfs is pooling a NFS mount then root squash must be disabled
 as mergerfs needs to be able to have elevated privileges to do what it
-does.
+does (set permissions, ownership, etc.)
 
-If you are exporting mergerfs over NFS then it is not really necessary.
+If you are exporting mergerfs over NFS it is not strictly necessary to
+disable root squashing but 3rd party software running as root may
+fail.
 
 See the [section on remote filesystems.](../remote_filesystems.md)
 

mkdocs/docs/known_issues_bugs.md

@@ -29,15 +29,28 @@
 
 #### Host vs Container identity
 
-While not a bug some users have found when using containers that
+While **not** a bug some users have found when using containers that
 supplemental groups defined inside the container don't work as
-expected. Since mergerfs lives outside the container it is querying
-the host's group database. Containers have their own user and group
-definitions unless setup otherwise just as different systems would.
+expected. Since mergerfs (typically) lives outside the container it is
+querying the host's supplemental group database. Containers have their
+own user and group definitions unless setup otherwise just as
+different systems would.
 
 Users should mount in the host group file into the containers or use a
 standard shared user and groups technology like NIS or LDAP.
 
+If using Docker or Podman containers with mergerfs running outside
+then you can pass in `/etc/passwd` and `/etc/group`.
+
+```
+docker run \
+  -v /etc/passwd:/etc/passwd:ro \
+  -v /etc/group:/etc/group:ro \
+  -u $(id -u):$(id -g) \
+  -v /data:/data \
+  containerimage
+```
+
 
 ### directory mtime is not being updated
 

mkdocs/docs/remote_filesystems.md

@@ -120,11 +120,11 @@ value. An easy way to generate a random value is to use the command
 line tool `uuid` or `uuidgen` or through a website such as
 [uuidgenerator.net](https://www.uuidgenerator.net/).
 
-`no_root_squash` is required for the same reason mergerfs needs to run
-as `root`. Certain behaviors of mergerfs require control over the
-filesystem that only `root` can perform. If squashing is enabled, or
-mergerfs was running as non-root, it would be unable to perform
-certain function and you will receive permission errors.
+`no_root_squash` is not *technically* required but suggested. If NFS
+is root squashing then any request that an app running as root makes
+will show up as a different user to mergerfs. This is perfectly fine
+so long as the client software using NFS are not running as root and
+expect to have root like privileges.
 
 
 ## SMB / CIFS