---
title: "NFS reference"
slug: "dev-datastore-reference-nfs"
updated: 2026-10-28T02:15:03Z
published: 2026-10-28T02:15:03Z
canonical: "docs.vastdata.com/dev-datastore-reference-nfs"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.vastdata.com/llms.txt
> Use this file to discover all available pages before exploring further.

# NFS reference

*Applies to VAST Cluster 5.5.*

What VAST Cluster 5.5 supports over NFS, from the client's point of view. For how to use it in an application, see [NFS for applications](/develop/docs/dev-datastore-guides-nfs-for-applications). Export, view policy and tenant settings are admin tasks; the KB links say where they're documented.

## Versions

| Version | Supported | Notes |
| --- | --- | --- |
| NFSv3 | Yes | Mount by the view's path or its NFS alias. NLMv4 byte-range locks. POSIX ACLs (`setfacl`) when the view policy allows them. |
| NFSv4.1 | Yes | Built-in locking, NFSv4 ACLs (with the Mixed Last Wins flavor), ID mapping with Active Directory, Kerberos, file delegations. |
| NFSv4.2 | Yes | Everything in 4.1, plus extended attributes and security labels. Must be enabled for the tenant. Recommended version for delegations. |
| NFSv4.0 | No | A `vers=4.0` mount fails with `mount.nfs: Protocol not supported`. |

## Features

| Feature | Versions | What you need to know |
| --- | --- | --- |
| `nconnect` | 3, 4.1 | Up to 16 TCP connections to one VIP. Recent Linux kernels, or the VAST-NFS driver. |
| NFS over RDMA | 3, 4.1 | InfiniBand or RoCE. VAST-NFS recommended on older distributions. TLS isn't supported over RDMA with 4.1. |
| Multipath | 3, 4.1 | Connections over a range of VIPs (`remoteports=`). Needs the VAST-NFS driver. |
| GPUDirect Storage | with RDMA | Through VAST-NFS. |
| Byte-range locks | 3 (NLM), 4.1+ | Advisory: a conflicting `fcntl` lock from another process fails, a lock on another range succeeds. A limited number of locks per file at once. Stale locks can be released by your platform team. |
| Extended attributes | 4.2 | `user.` namespace on Linux. Files and directories, not symlinks. Read and write need read and write permission (or the NFSv4 xattr access bits). |
| File delegations | 4.1, 4.2 | Set per tenant and per view. Need NTP on client and cluster and a backchannel; not supported for SLES 12 and CentOS 7 clients; VAST-NFS 4.0.32 or later if you use it. Close-to-open consistency only between NFSv4 clients. Recalled on failover. |
| NFSv4 ACLs | 4.1+ | Can be set by clients only with the Mixed Last Wins security flavor. |
| ID mapping | 4.1+ | User and group names as `user@domain`, with the client and cluster in the same Active Directory domain. Kerberos mounts always use it. |
| Kerberos | 4.1+ | `krb5`, `krb5i`, `krb5p`; a view policy can require integrity or privacy. MIT Kerberos providers serve NFSv4 only. |
| TLS and mTLS | 3, 4 | Encrypted NFS, and client certificates for tenant identification. For NFSv3 with mTLS: VAST-NFS and `mountproto=tcp`. |
| `rquota` | 3 | Read your quota; `SETQUOTA` isn't supported, nor quotas on NFS aliases. |
| Trash folder | 3, 4.1 | Move a directory to the trash for fast background deletion, if enabled. |

## Access rules that affect clients

- **Host rules.** A view policy lists which client addresses may mount, read-write or read-only, per protocol. A mount from another address is refused with `mount.nfs: access denied by server while mounting ...`.
- **Squash.** Per host, the view policy can map root (root squash) or every user (all squash) to `nobody`, for NFSv3. If your files end up owned by `nobody`, this is the first thing to check. With the S3 Native flavor, a squashed root can't create files at all, even in a directory with mode 777.
- **Security modes.** The view policy decides which RPC security flavors a mount may use: `AUTH_SYS`, and Kerberos `krb5`, `krb5i` or `krb5p`. It can require Kerberos, integrity or privacy.
- **Group sources.** The view policy decides whether a user's groups come from the RPC (the client's GIDs), from the directory providers, or both.
- **Nested views.** A view with NFSv4 needs NFSv4 on all views above it, including a view on `/` if the cluster has one. Otherwise VMS warns when the view is created, and an NFSv4.1 or 4.2 mount of it fails with `mount.nfs: Operation not permitted`. An NFSv4.1-only view under an NFSv3-only parent can be used through an existing mount but can't be mounted.
- **Unknown owners.** With NFSv4, if the cluster can't resolve a file's user or group, `GETATTR` returns `BADOWNER` and the client shows `nobody`.

## Names

By default a file or directory name can be up to 255 characters (`File name too long` beyond that), using only characters every supported protocol allows. A view policy can relax both. Extended-attribute names and values follow the same setting. See [limits](/develop/docs/dev-datastore-reference-limits#nfs-and-file-names).

## See also

- KB: [NFS File Sharing Protocol](/docs-5-5/docs/nfs-file-sharing-protocol) (all NFS pages), [NFSv4 File Delegations](/docs-5-5/docs/nfsv4-file-delegations), [NFSv4.2 Extended Attributes](/docs-5-5/docs/nfsv4-2-extended-attributes), [NFSv4 ACLs](/docs-5-5/docs/nfsv4-acls) and [Managing View Policies](/docs-5-5/docs/managing-view-policies).