CentOS 7 上的 Docker 卷

Question

我在 CentOS 7 上尝试将卷映射到 tomcat 容器中的主机时遇到问题。公共的 tomcat 镜像和我创建的镜像都会发生这种情况（基于 centos 而不是 debian）。

如下实例化容器将成功： docker run -it -d tomcat:8

按如下方式实例化容器会成功，但日志中有错误且日志不会写入主机： docker run -it -d -v /usr/local/tomcat:/usr/local/tomcat tomcat:8

[wpackard@eagle2 tomcat]$ dkr run -it -d -v 

/usr/local/tomcat:/usr/local/tomcat tomcat:8
34075701b1436f83a24212170b4d2113ae698df244c449203b1c9af9814485c9
[wpackard@eagle2 tomcat]$ dkr ps
CONTAINER ID        IMAGE               COMMAND             CREATED             STATUS              PORTS               NAMES
34075701b143        tomcat:8            "catalina.sh run"   5 seconds ago       Up 4 seconds        8080/tcp            sharp_einstein
[wpackard@eagle2 tomcat]$ dkr logs sharp_einstein
Using CATALINA_BASE:   /usr/local/tomcat
Using CATALINA_HOME:   /usr/local/tomcat
Using CATALINA_TMPDIR: /usr/local/tomcat/temp
Using JRE_HOME:        /usr
Using CLASSPATH:       /usr/local/tomcat/bin/bootstrap.jar:/usr/local/tomcat/bin/tomcat-juli.jar
java.util.logging.ErrorManager: 4
java.io.FileNotFoundException: /usr/local/tomcat/logs/catalina.2015-03-31.log (Permission denied)

...

31-Mar-2015 15:32:04.088 SEVERE [Catalina-startStop-1] org.apache.catalina.startup.HostConfig.start Unable to create directory for deployment: /usr/local/tomcat/conf/Catalina/localhost
31-Mar-2015 15:32:04.097 INFO [localhost-startStop-1] org.apache.catalina.startup.HostConfig.deployDirectory Deploying web application directory /usr/local/tomcat/webapps/ROOT
31-Mar-2015 15:32:04.468 WARNING [localhost-startStop-1] org.apache.catalina.core.StandardContext.postWorkDirectory Failed to create work directory [/usr/local/tomcat/work/Catalina/localhost/ROOT] for context []
31-Mar-2015 15:32:05.966 SEVERE [localhost-startStop-1] org.apache.jasper.EmbeddedServletOptions.<init> The scratchDir you specified: /usr/local/tomcat/work/Catalina/localhost/ROOT is unusable.
31-Mar-2015 15:32:06.042 INFO [localhost-startStop-1] org.apache.catalina.startup.HostConfig.deployDirectory Deployment of web application directory /usr/local/tomcat/webapps/ROOT has finished in 1,929 ms
31-Mar-2015 15:32:06.043 INFO [localhost-startStop-1] org.apache.catalina.startup.HostConfig.deployDirectory Deploying web application directory /usr/local/tomcat/webapps/docs
31-Mar-2015 15:32:06.093 WARNING [localhost-startStop-1] org.apache.catalina.core.StandardContext.postWorkDirectory Failed to create work directory [/usr/local/tomcat/work/Catalina/localhost/docs] for context [/docs]
31-Mar-2015 15:32:06.216 SEVERE [localhost-startStop-1] org.apache.jasper.EmbeddedServletOptions.<init> The scratchDir you specified: /usr/local/tomcat/work/Catalina/localhost/docs is unusable.
31-Mar-2015 15:32:06.219 INFO [localhost-startStop-1] org.apache.catalina.startup.HostConfig.deployDirectory Deployment of web application directory /usr/local/tomcat/webapps/docs has finished in 176 ms
31-Mar-2015 15:32:06.220 INFO [localhost-startStop-1] org.apache.catalina.startup.HostConfig.deployDirectory Deploying web application directory /usr/local/tomcat/webapps/examples
31-Mar-2015 15:32:06.272 WARNING [localhost-startStop-1] org.apache.catalina.core.StandardContext.postWorkDirectory Failed to create work directory [/usr/local/tomcat/work/Catalina/localhost/examples] for context [/examples]
31-Mar-2015 15:32:07.952 SEVERE [localhost-startStop-1] org.apache.jasper.EmbeddedServletOptions.<init> The scratchDir you specified: /usr/local/tomcat/work/Catalina/localhost/examples is unusable.
[wpackard@eagle2 tomcat]$

执行到容器并尝试写入也失败。

[wpackard@eagle2 tomcat]$ dkr ps
CONTAINER ID        IMAGE               COMMAND             CREATED             STATUS              PORTS               NAMES
34075701b143        tomcat:8            "catalina.sh run"   5 minutes ago       Up 5 minutes        8080/tcp            sharp_einstein
[wpackard@eagle2 tomcat]$ dkr exec -it sharp_einstein /bin/bash
root@34075701b143:/usr/local/tomcat# ls -l
total 96
-rw-rw-r--. 1 root root 56977 Jan 23 11:59 LICENSE
-rw-rw-r--. 1 root root  1397 Jan 23 11:59 NOTICE
-rw-rw-r--. 1 root root  6779 Jan 23 11:59 RELEASE-NOTES
-rw-rw-r--. 1 root root 16204 Jan 23 11:59 RUNNING.txt
drwxrwxr-x. 2 root root  4096 Mar 31 12:14 bin
drwxrwxr-x. 2 root root  4096 Jan 23 11:59 conf
drwxrwxr-x. 2 root root  4096 Mar 31 12:14 lib
drwxrwxr-x. 2 root root     6 Jan 23 11:56 logs
drwxrwxr-x. 2 root root    29 Mar 31 12:14 temp
drwxrwxr-x. 7 root root    76 Jan 23 11:57 webapps
drwxrwxr-x. 2 root root     6 Jan 23 11:56 work
root@34075701b143:/usr/local/tomcat# cd logs
root@34075701b143:/usr/local/tomcat/logs# echo "test" > test.log
bash: test.log: Permission denied

我在 centos 上创建了 postgresql 容器的实例，并成功映射和使用了该卷，通过创建数据库、停止实例然后重新运行容器进行验证。

[wpackard@eagle2 ~]$ uname --all
Linux eagle2 3.10.0-123.20.1.el7.x86_64 #1 SMP Thu Jan 29 18:05:33 UTC 2015 x86_64 x86_64 x86_64 GNU/Linux
[wpackard@eagle2 ~]$

dkr 是 docker 的别名，我创建了一个 docker 组并将自己添加到组中以消除对 sudo 的需要。

卷映射似乎在 ubuntu 上正常工作。在 CentOS 上，我尝试了两个软件包版本（如下），并将其更新到 1.5。

[wpackard@eagle2 ~]$ dkr --version
Docker version 1.3.2, build 39fa2fa/1.3.2
[wpackard@eagle2 ~]$

如何使卷在 CentOS 上工作？

Answer 1

我认为您的卷正在运行 :-) 您有权限问题。我经常在主机和容器之间的用户 ID 映射中遇到这种情况。在您的主机上，如果您查看 /usr/local/tomcat (ls -ld)，您将看到所有者、组和权限。您可能有类似 0755 的内容（所有者读取/写入/执行，组读取/执行，世界读取/执行。您可以轻松测试这个理论，只需记住 /usr/local/tomcat/logs 的当前设置，然后做：

chmod 777 /usr/local/tomcat/logs

来自 docker 主机（不是容器）。然后在容器上运行你的测试，Permission denied 应该消失了。

不过，这不是一个好的解决方法。我不知道社区对 docker 的用户 ID 映射有何看法。您可以做的一件事是找出主机中该目录的用户和组。然后，当您创建映像（或在运行时）时，在容器中创建一个具有相同 id 的用户和一个具有相同 id 的组。然后在容器中使用该用户运行您的 tomcat 服务。

Answer 2

这是由于 SELinux。

您必须将正确的类型附加到主机目录：

host$ chcon -Rt svirt_sandbox_file_t /usr/local/tomcat