Function Compute:Dynamically mount File Storage NAS

Core capabilities

The dynamic NAS mount feature in Function Compute lets you mount a dedicated NAS directory for a session when you create the session. You can also specify an independent user identity (POSIX UID/GID) as needed. The core features include the following:

• Dynamic and on-demand: Storage mounting is tied to the session lifecycle. Storage is allocated only when needed and is automatically detached when the session is destroyed.

• Strong isolation: By assigning a unique User ID and Group ID to each session, you can completely isolate data access permissions for different tenants at the file system level.

• High flexibility: You can mount different subdirectories of the NAS file system for different tenants. This makes data partitioning easy.

• Performance optimization: Combined with session prefetching, you can pre-mount data directories when an instance starts. This speeds up the loading of models or data.

How it works

This feature deeply integrates the NAS mount operation with the CreateSession API call. The following process uses HeaderField affinity as an example:

Step 1: Configure the function (prerequisites)

To enable dynamic NAS mounting for a session, you must complete three key settings when you create a function or update its configuration:

1. Enable session affinity:

   1. Log on to the Function Compute console and click Function Management > Functions.

   2. On the Functions page, click the name of the target function to go to its details page.

   3. Choose the Configurations tab. Click to the right of Advanced Settings.

   4. Turn on the Session Affinity switch, select HeaderField affinity, and configure the Header Name (example: x-affinity-header-v1).

      Note

      The name cannot start with the x-fc- prefix. It must start with a letter. The subsequent characters can be digits, hyphens (-), underscores (_), or letters. The length must be between 5 and 40 characters.

   5. Click Deploy to apply the configuration.

2. Enable instance isolation: Navigate to Configurations > Advanced Settings > Instance isolation and select Session Isolation.

3. Allow access to VPC:

   • Navigate to Configurations > Advanced Settings > Network and enable Access To VPC.

   • For Configuration Mode, select Custom Configuration.

   • For VPC, select the VPC that contains the mount target.

Step 2: Create a session with a NAS configuration

1. Install dependencies

   macOS / Linux

   # Install using pip3
   pip3 install alibabacloud_fc20230330 alibabacloud_credentials alibabacloud_tea_openapi alibabacloud_tea_util
   
   # If you encounter permission issues, use the --user parameter
   pip3 install --user alibabacloud_fc20230330 alibabacloud_credentials alibabacloud_tea_openapi alibabacloud_tea_util
   
   # For macOS Homebrew Python environments, use --break-system-packages
   pip3 install --break-system-packages alibabacloud_fc20230330 alibabacloud_credentials alibabacloud_tea_openapi alibabacloud_tea_util

   Windows

   # Install using pip
   pip install alibabacloud_fc20230330 alibabacloud_credentials alibabacloud_tea_openapi alibabacloud_tea_util
   
   # Or, specify Python 3
   py -3 -m pip install alibabacloud_fc20230330 alibabacloud_credentials alibabacloud_tea_openapi alibabacloud_tea_util

2. Write the code to create a session

   Create a Python code file, for example, createSession.py. Copy the following code into the file and replace the core parameters. The example shows how to create a session for 'Tenant A'. It mounts the tenant's dedicated NAS directory (<YOUR-NAS-SERVER-ADDR>:/tenant-a-data) to the /mnt/data path in the instance and specifies the user identity as UID=1001 and GID=1001.

   Core methods and parameters:

   Important

   You can simultaneously configure dynamic NAS mounting for a session and NAS mounting for a function in Configuration > Advanced Configuration > Storage. However, note the following:

   • The User ID/Group ID defined in NASConfig below must be consistent with the user (User ID)/user group (Group ID) used in the function mount configuration.

   • The same mount path (mount_dir) cannot be used for both session dynamic mounting and function mounting.

   • config.endpoint:

     • <Account ID>: Replace with your Alibaba Cloud account ID.

     • <Endpoint>: For more information, see the list of Function Compute 3.0 service endpoints. The format is fcv3.[region_id].aliyuns.com.

   • CreateSessionInput:

     • session_ttlin_seconds: The total session lifecycle in seconds.

     • session_idle_timeout_in_seconds: The session idle timeout in seconds.

   • client.create_session_with_options: Replace <Function Name> with the name of the function for which you are creating the session.

     • NASMountConfig: NAS mount configuration.

       • mount_dir: The mount path in the instance, such as /home/test.

       • server_addr: The NAS file system address and the tenant's dedicated subdirectory.

     • user_id: Specifies an independent POSIX User ID for this session.

     • group_id: Specifies an independent POSIX Group ID for this session.

   # -*- coding: utf-8 -*-
   from alibabacloud_fc20230330.client import Client as FC20230330Client
   from alibabacloud_credentials.client import Client as CredentialClient
   from alibabacloud_tea_openapi import models as open_api_models
   from alibabacloud_fc20230330 import models as fc20230330_models
   from alibabacloud_tea_util import models as util_models
   
   # 1. Create an account client.
   credential = CredentialClient()
   config = open_api_models.Config(credential=credential)
   config.endpoint = f'<Account ID>.<Endpoint>'
   client = FC20230330Client(config)
   
   # 2. Prepare the NAS mount configuration.
   nas_mount_config = fc20230330_models.NASMountConfig(
       mount_dir='/mnt/data',  # Mount path in the instance
       server_addr='<YOUR-NAS-SERVER-ADDR>:/<tenant-a-path>'  # NAS file system address and the tenant's dedicated subdirectory
   )
   
   # 3. Configure NAS and user identity (assign a unique UID/GID to Tenant A).
   nas_config = fc20230330_models.NASConfig(
       mount_points=[nas_mount_config],
       user_id=1001,  # Specify an independent POSIX User ID for this session.
       group_id=1001  # Specify an independent POSIX Group ID for this session.
   )
   
   # 4. Construct the CreateSession request.
   create_session_input = fc20230330_models.CreateSessionInput(
       nas_config=nas_config,
       session_ttlin_seconds=3600,
       session_idle_timeout_in_seconds=600
   )
   create_session_request = fc20230330_models.CreateSessionRequest(
       body=create_session_input
   )
   
   # 5. Send the request.
   runtime = util_models.RuntimeOptions()
   response = client.create_session_with_options('<Function Name>', create_session_request, {}, runtime)
   
   # 6. Get the session ID from the response.
   print(response.body.to_map())
   session_id = response.body.session_id
   print(f"Session created successfully. Session ID: {session_id}")
   

3. Run the code

   export ALIBABA_CLOUD_ACCESS_KEY_ID=LTAI****************
   export ALIBABA_CLOUD_ACCESS_KEY_SECRET=<yourAccessKeySecret>
   python3 creatSession.py

   Parameters:

   • ALIBABA_CLOUD_ACCESS_KEY_ID: The AccessKey ID of your Alibaba Cloud account or RAM user.

   • ALIBABA_CLOUD_ACCESS_KEY_SECRET: The AccessKey secret of your Alibaba Cloud account or RAM user.

4. Sample response

   {
     'containerId': 'c-********-********-************', 
     'createdTime': '2025-10-30T06:38:10Z', 
     'functionName': '****', 
     'lastModifiedTime': '2025-10-30T06:38:10Z', 
     'nasConfig': 
       {
         'groupId': 1001, 
         'mountPoints': [
           {
             'enableTLS': False, 
             'mountDir': '/home/test', 
             'serverAddr': '*-*.*.nas.aliyuncs.com:/test'
              }
                ], 
                'userId': 1001
                }, 
      'qualifier': 'LATEST', 
      'sessionAffinityType': 'HEADER_FIELD', 
      'sessionId': '******************', 
      'sessionIdleTimeoutInSeconds': 600, 
      'sessionStatus': 'Active', 
      'sessionTTLInSeconds': 3600
      }
   Session created successfully. Session ID: ************

Step 3: Use the mounted NAS in the function

Now, when you call the function, you can include the SessionID obtained in the previous step. The function instance can then access the mounted /mnt/data directory. The following example uses a web function:

1. Modify the function code and redeploy it.

   import os
   from flask import Flask, request, jsonify
   
   # ... (app setup) ...
   
   # Assume the NAS mount target is at /mnt/data
   NAS_MOUNT_PATH = '/mnt/data'
   app = Flask(__name__)
   
   
   @app.route('/<path:path>', methods=['GET', 'POST'])
   def handle_nas_request(path):
       rid = request.headers.get('x-fc-request-id')
       print(f"FC Invoke Start RequestId: {rid}")
   
       # Construct the full path of the file on NAS
       # Note: Prevent path traversal attacks
       safe_path = os.path.normpath(os.path.join(NAS_MOUNT_PATH, path))
       if not safe_path.startswith(NAS_MOUNT_PATH):
           return "Path traversal attempt detected!", 400
   
       response_data = {}
   
       if request.method == 'POST':
           # Write to the file
           body = request.data.decode('utf-8')
           try:
               with open(safe_path, 'w') as f:
                   f.write(body)
               response_data['message'] = f"Successfully wrote to {safe_path}"
               print(f"Wrote to {safe_path}")
           except Exception as e:
               return str(e), 500
   
       elif request.method == 'GET':
           # Read from the file
           try:
               if os.path.exists(safe_path) and os.path.isfile(safe_path):
                   with open(safe_path, 'r') as f:
                       content = f.read()
                   response_data['content'] = content
                   print(f"Read from {safe_path}")
               else:
                   return f"File not found: {safe_path}", 404
           except Exception as e:
               return str(e), 500
   
       print(f"FC Invoke End RequestId: {rid}")
       return jsonify(response_data)  # Use jsonify to return a response in JSON format
   
   # ... (if __name__ == '__main__': block) ...
   

2. Call the function and verify the result.

   Call the InvokeFunction API to call the function with the session.

   Sample code and description:

   InvokeFunctionHeaders: Construct the request header. Include the sessionId returned in the previous step in the request header. The value of the Header Key must be the same as the value that you set when you enabled session affinity, for example, x-affinity-header-v1. This binds the session for routing.

   # -*- coding: utf-8 -*-
   from alibabacloud_fc20230330.client import Client as FC20230330Client
   from alibabacloud_credentials.client import Client as CredentialClient
   from alibabacloud_tea_openapi import models as open_api_models
   from alibabacloud_fc20230330 import models as fc20230330_models
   from alibabacloud_tea_util import models as util_models
   
   session_id = '************'
   function_name = 'my-session-nas'
   # 1. Create an account client.
   credential = CredentialClient()
   config = open_api_models.Config(credential=credential)
   config.endpoint = f'<Account ID>.<Endpoint>'
   client = FC20230330Client(config)
   
   # 2. Construct the request header. The Header Key (x-affinity-header-v1) must match the session affinity key configured for the function.
   headers = fc20230330_models.InvokeFunctionHeaders(
       common_headers={
           "x-affinity-header-v1": session_id
       }
   )
   
   # 3. Construct the invocation request (you can pass a body as needed).
   invoke_request = fc20230330_models.InvokeFunctionRequest(
       body='your_request_payload'.encode('utf-8')  # Sample payload
   )
   
   runtime = util_models.RuntimeOptions()
   
   try:
       # 4. Send the invocation.
       invoke_response = client.invoke_function_with_options(
           function_name,
           invoke_request,
           headers,
           runtime
       )
       # 5. Process the response.
       print(f"Status Code: {invoke_response.status_code}")
       print(f"Response Body: {invoke_response.body.decode('utf-8')}")
   except Exception as error:
       print(error.message)