proxmox 5가 설치된 홈 서버와 도커 컨테이너에 일부 서비스가 있습니다. 어제까지는 모든 것이 괜찮았습니다.
서버를 다시 시작했는데 모든 컨테이너의 모든 서비스가 권한 거부로 인해 소켓을 바인딩할 수 없었습니다. 나는 매우 슬프다...
다음은 몇 가지 기술적인 세부정보입니다.
Linux server 4.10.15-1-pve #1 SMP PVE 4.10.15-15 (Fri, 23 Jun 2017 08:57:55 +0200) x86_64 GNU/Linux
Docker version 18.03.0-ce, build 0520e24
docker-compose version 1.20.1, build 5d8c71b
캐디 docker-compose.yml
version: '2'
services:
caddy:
container_name: caddy
image: zzrot/alpine-caddy:latest
restart: unless-stopped
network_mode: "host"
environment:
- PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
hostname: caddy
volumes:
- /etc/localtime:/etc/localtime:ro
- /mirror/config/caddy-config/certs:/root/.caddy
- /mirror/config/caddy-config/caddy:/etc/Caddyfile
docker-compose 출력
root@server:~/compose/caddy# docker-compose up
Creating caddy ... done
Attaching to caddy
caddy | Activating privacy features... done.
caddy | 2018/03/23 19:55:21 listen tcp :443: socket: permission denied
caddy exited with code 1
mariadb docker-compose.yml
version: '3.1'
services:
mariadb:
container_name: mariadb
image: mariadb
restart: always
ports:
- 3306:3306/udp
- 3306:3306/tcp
environment:
- PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
- MYSQL_ROOT_PASSWORD=password
hostname: mariadb
volumes:
- /mirror/config/mariadb-config/databases:/var/lib/mysql
- /mirror/config/custom.cnf:/etc/mysql/conf.d/config-file.cnf
- /mirror/config/logs:/config/logs
docker-compose 출력
mariadb_1 | 2018-03-23 13:20:36 139659836417920 [Warning] Failed to create a socket for IPv6 '::': errno: 13.
mariadb_1 | 2018-03-23 13:20:36 139659836417920 [Warning] Failed to create a socket for IPv4 '0.0.0.0': errno: 13.
mariadb_1 | 2018-03-23 13:20:36 139659836417920 [ERROR] Can't create IP socket: Permission denied
mariadb_1 | 2018-03-23 13:20:36 139659836417920 [ERROR] Aborting
mariadb_1 |
mariadb_mariadb_1 exited with code 1
그 이유는 무엇입니까?
업데이트: 몇 가지 새로운 세부정보
kernel: audit: type=1400 audit(1521896913.536:10071): apparmor="DENIED" operation="create" profile="docker-default" pid=16502 comm="mysqld" family="inet" sock_type="dgram" protocol=0 requested_mask="create" denied_
audit[16271]: AVC apparmor="DENIED" operation="create" profile="docker-default" pid=16271 comm="caddy" family="inet" sock_type="dgram" protocol=0 requested_mask="create" denied_mask="create"
답변1
docker-compose에 security_opt를 추가했는데 문제가 사라졌습니다.
security_opt:
- apparmor:unconfined
그러나 나는 이 선택이 문제에 대한 완전히 올바른 해결책이라고 생각하지 않습니다.