{"id":36736,"date":"2019-10-31T22:13:26","date_gmt":"2019-10-31T19:13:26","guid":{"rendered":"https:\/\/prohoster.info\/blog\/istoriya-problemy-perenosa-docker-storage-docker-root\/"},"modified":"2019-10-31T22:13:26","modified_gmt":"2019-10-31T19:13:26","slug":"istoriya-problemy-perenosa-docker-storage-docker-root","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/istoriya-problemy-perenosa-docker-storage-docker-root","title":{"rendered":"Dockeri salvestuse (docker root) probleemide ajalugu","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Eelmisel n\u00e4dalal otsustati \u00fchel serveritel viia dockeri salvestus (kataloog, kus docker hoiab k\u00f5iki konteinerite faile ja pilte) eraldi sektsiooni, mis
\nomab suuremat mahtu. \u00dclesanne tundus triviaalne ja ei ennustanud probleeme\u2026
\n<\/a><\/noindex>
\nAlustame:<\/p>\n

1. Peatame ja tapame k\u00f5ik meie rakenduse konteinerid: <\/p>\n

docker-compose down<\/code><\/pre>\n
\nkui konteinerite arv on suur ja nad on erinevates compose\u2019is, saab teha nii: <\/p>\n
docker rm -f $(docker ps -q)<\/code><\/pre>\n
\n2. Peatame docker daemon\u2019i: <\/p>\n
systemctl stop docker<\/code><\/pre>\n
\n3. Kolime katalooge vajalikku kohta: <\/p>\n
cp -r \/var\/lib\/docker \/docker\/data\/storage<\/code><\/pre>\n
\n4. Teatame docker daemon\u2019ile, et ta vaataks uude katalooge. Siin on mitmeid variante: kas lisada daemon\u2019ile uue tee kaudu -g lipp, v\u00f5i kasutada systemd konfiguratsioone, mida me kasutasime. V\u00f5i ka s\u00fcmboolne link. Ma ei hakka seda liiga palju lahti seletama, internetis on rohkelt<\/a><\/noindex> kasutuse \u00f5petusi docker root\u2019i uude kohta viimise kohta.<\/p>\n
5. K\u00e4ivitame docker daemon\u2019i ja j\u00e4lgime, et ta vaataks \u00f5igesse kohta: <\/p>\n
systemctl status docker<\/code><\/pre>\n
\n\u00dches v\u00e4ljundi real peaksime n\u00e4gema:<\/p>\n
\u251c\u250019493 \/usr\/bin\/dockerd --data-root=\/docker\/data\/storage<\/code><\/pre>\n
\nVeendusime, et daemonile on valik edastatud, n\u00fc\u00fcd kontrollime, kas ta rakendas selle (t\u00e4nud inkvizitor68sl<\/a><\/noindex>)!<\/p>\n
docker info | awk '\/Root Dir\/ {print $NF}' <\/code><\/pre>\n
\n6. K\u00e4ivitame meie rakenduse: <\/p>\n
docker-compose up -d<\/code><\/pre>\n
\n7. Kontrollime<\/p>\n
Ja siin see muutub huvitavaks, DB, MQ, k\u00f5ik on korras! Andmebaas on t\u00fchjaks, k\u00f5ik t\u00f6\u00f6tab... v\u00e4lja arvatud nginx. Meil on oma build nginx Kerberos'e ja kurtisaanidega. Ja konteineri logide vaatamine n\u00e4itas, et ta ei saa kirjutada \/var\/tmp \u2014 Juhtimine keelatud. Hingan s\u00fcgavalt sisse ja proovisin olukorda anal\u00fc\u00fcsida\u2026 Kuidas nii? Docker'i image ei muutunud. Me lihtsalt liikusime katalooge. On alati t\u00f6\u00f6tanud, ja n\u00fc\u00fcd \u00e4kki\u2026 Eksperimendi huvides l\u00e4ksin k\u00e4sitsi konteinerisse ja muutsin antud katalooge \u00f5igusi, need olid root, root 755<\/u>, andsin root, root 777<\/u>. Ja k\u00f5ik hakkas t\u00f6\u00f6le\u2026 Peas kajas m\u00f5te \u2014 mis jura see on\u2026 Olin m\u00f5elnud, et v\u00f5ib-olla olin midagi t\u00e4helepanuta j\u00e4tnud\u2026 <\/p>\n
Otsustasin, et me kaotasime failide \u00f5igused nende \u00fcleviimisel. Peatasime rakenduse, docker daemon'i, kustutasime uue katalooge ja tegime \/var\/lib\/docker katalooge kopeerimise, kasutades rsync -a<\/code>. <\/p>\n
M\u00f5tlesin, et n\u00fc\u00fcd on kindlasti k\u00f5ik h\u00e4sti, t\u00f5stame Docker'i ja rakenduse.<\/p>\n
Ja\u2026 probleem p\u00fcsib\u2026 Mu silm t\u00f5mbleb. Tormasin oma virtuaalmasina konsooli, kus teen erinevaid teste, mul oli see nginx pilt ja ma sisenesin konteinerisse, ning seal kataloogis \/var\/tmp olid \u00f5igused root, root 777. Seega sellised, nagu pidin k\u00e4sitsi seadma. Aga pildid on ju identsed! <\/p>\n
Kasutati failis\u00fcsteemi xfs.<\/u><\/p>\n
V\u00f5rdlesin k\u00e4su kaudu <\/p>\n
docker inspect my-nginx:12345<\/code><\/pre>\n
\nK\u00f5ik hashid on identsed, k\u00f5ik \u00fcks \u00fchele. Nii serveris kui ka mu virtuaalmasinas. Kustutasin kohaliku nginx pildi ja t\u00f5mbasin selle uuesti registry'lt, mis mitmel p\u00f5hjusel on sellel samal masinal. Ja probleem on sama\u2026 N\u00fc\u00fcd t\u00f5mbleb mul teine silm.<\/p>\n
Ma ei m\u00e4leta enam, millised m\u00f5tted mu peas olid peale h\u00fc\u00fcde \u201eAAAAAAA\u201c ja muu. V\u00e4ljas on kell neli \u00f6\u00f6sel, avasin docker'i l\u00e4htekoodid, et m\u00f5ista pildi kihtide hashimise p\u00f5him\u00f5tet. Ava kolmas energiajook. Ja l\u00f5puks sain aru, et hashimine arvestab ainult faili, selle sisu, aga EI OLE \u00d5IGUSTE K\u00dcSIMUS<\/b>! See t\u00e4hendab, et mingil salap\u00e4rasel viisil on meie \u00f5igused rikutud, kuigi selinux on v\u00e4lja l\u00fclitatud, acl ei ole kasutusel, sticky bit puudub. <\/p>\n
Kustutasin kohaliku pildi, kustutasin ka pildi docker registry's ning t\u00f5ukasin uuesti \u00fcles. Ja k\u00f5ik t\u00f6\u00f6tas. Tundub, et \u00f5igused said \u00fclekandmisel rikutud, nii kohaliku pildi sees kui ka registris olevas pildis. Nagu ma juba \u00fctlesin, asus see mitmel p\u00f5hjusel ikka veel samas seadmes. Ja seega \u00fches kataloogis \/var\/lib\/docker.<\/p>\n
Ja ette aimates k\u00fcsimust, kas oleme proovinud suunata docker tagasi vana katalooge \u2014 ei, ei ole proovinud, kahjuks ei lubanud asjaolud. Ja t\u00f5esti tahtsin \u00e4ra lahendada.<\/p>\n
P\u00e4rast selle artikli kirjutamist tundub mulle, et probleemile lahendamine on ilmne, kuid uurimise hetkel ei tundunud see nii. Ausalt \u00f6eldes googeldasin ja ei leidnud sarnaseid olukordi.<\/p>\n
Kokkuv\u00f5te: probleemi lahendasin, p\u00f5hjus j\u00e4i segaseks =(<\/p>\n
Kui keegi teab, aimab v\u00f5i on mingi n\u00e4gemus v\u00f5imalike p\u00f5hjuste kohta \u2014 oleksin \u00e4\u00e4rmiselt t\u00e4nulik kommentaarides!
\n
Allikas: habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"
\u041d\u0435 \u0434\u0430\u043b\u0435\u0435, \u0447\u0435\u043c \u043f\u0430\u0440\u0443 \u0434\u043d\u0435\u0439 \u043d\u0430\u0437\u0430\u0434 \u0431\u044b\u043b\u043e \u0440\u0435\u0448\u0435\u043d\u043e \u043d\u0430 \u043e\u0434\u043d\u043e\u043c \u0438\u0437 \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432 \u0432\u044b\u043d\u0435\u0441\u0442\u0438 docker storage (\u043a\u0430\u0442\u0430\u043b\u043e\u0433, \u0433\u0434\u0435 \u0434\u043e\u043a\u0435\u0440 \u0445\u0440\u0430\u043d\u0438\u0442 \u0432\u0441\u0435 \u0444\u0430\u0439\u043b\u044b \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u043e\u0432, \u043e\u0431\u0440\u0430\u0437\u043e\u0432) \u043d\u0430 \u043e\u0442\u0434\u0435\u043b\u044c\u043d\u044b\u0439 \u0440\u0430\u0437\u0434\u0435\u043b, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043e\u0431\u043b\u0430\u0434\u0430\u043b \u0431\u043e\u043b\u044c\u0448\u0435\u0439 \u0435\u043c\u043a\u043e\u0441\u0442\u044c\u044e. \u0417\u0430\u0434\u0430\u0447\u0430, \u043a\u0430\u0437\u0430\u043b\u043e\u0441\u044c \u0431\u044b, \u0442\u0440\u0438\u0432\u0438\u0430\u043b\u044c\u043d\u0430\u044f \u0438 \u043d\u0435 \u043f\u0440\u0435\u0434\u0432\u0435\u0449\u0430\u043b\u0430 \u0431\u0435\u0434\u044b\u2026 \u041f\u0440\u0438\u0441\u0442\u0443\u043f\u0430\u0435\u043c: 1. \u041e\u0441\u0442\u0430\u043d\u0430\u0432\u043b\u0438\u0432\u0430\u0435\u043c \u0438 \u0443\u0431\u0438\u0432\u0430\u0435\u043c \u0432\u0441\u0435 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u044b \u043d\u0430\u0448\u0435\u0433\u043e \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f: docker-compose down \u0435\u0441\u043b\u0438 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u043e\u0432 \u043c\u043d\u043e\u0433\u043e, \u0438 \u043e\u043d\u0438 \u0432 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-36736","post","type-post","status-publish","format-standard","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Probleemi lugu docker storage (docker root) \u00fcleviimisest | ProHoster","description":"M\u00f5ned p\u00e4evad tagasi otsustati \u00fchel serveril eraldada docker storage (kataloog, kus docker hoiab k\u00f5iki konteinerite faile ja pilte) eraldi partitsioonile, millel oli suurem maht. \u00dclesanne n\u00e4is esialgu lihtne ja ei olnud mingeid halbu ennustusi... Alustame: 1. Peatame ja tapame k\u00f5ik meie rakenduse konteinerid: docker-compose down, kui konteinerite arv on suur ja nad on","canonical_url":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/istoriya-problemy-perenosa-docker-storage-docker-root","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0418\u0441\u0442\u043e\u0440\u0438\u044f \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u043f\u0435\u0440\u0435\u043d\u043e\u0441\u0430 docker storage (docker root) | ProHoster","og:description":"\u041d\u0435 \u0434\u0430\u043b\u0435\u0435, \u0447\u0435\u043c \u043f\u0430\u0440\u0443 \u0434\u043d\u0435\u0439 \u043d\u0430\u0437\u0430\u0434 \u0431\u044b\u043b\u043e \u0440\u0435\u0448\u0435\u043d\u043e \u043d\u0430 \u043e\u0434\u043d\u043e\u043c \u0438\u0437 \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432 \u0432\u044b\u043d\u0435\u0441\u0442\u0438 docker storage (\u043a\u0430\u0442\u0430\u043b\u043e\u0433, \u0433\u0434\u0435 \u0434\u043e\u043a\u0435\u0440 \u0445\u0440\u0430\u043d\u0438\u0442 \u0432\u0441\u0435 \u0444\u0430\u0439\u043b\u044b \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u043e\u0432, \u043e\u0431\u0440\u0430\u0437\u043e\u0432) \u043d\u0430 \u043e\u0442\u0434\u0435\u043b\u044c\u043d\u044b\u0439 \u0440\u0430\u0437\u0434\u0435\u043b, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043e\u0431\u043b\u0430\u0434\u0430\u043b \u0431\u043e\u043b\u044c\u0448\u0435\u0439 \u0435\u043c\u043a\u043e\u0441\u0442\u044c\u044e. \u0417\u0430\u0434\u0430\u0447\u0430, \u043a\u0430\u0437\u0430\u043b\u043e\u0441\u044c \u0431\u044b, \u0442\u0440\u0438\u0432\u0438\u0430\u043b\u044c\u043d\u0430\u044f \u0438 \u043d\u0435 \u043f\u0440\u0435\u0434\u0432\u0435\u0449\u0430\u043b\u0430 \u0431\u0435\u0434\u044b\u2026 \u041f\u0440\u0438\u0441\u0442\u0443\u043f\u0430\u0435\u043c: 1. \u041e\u0441\u0442\u0430\u043d\u0430\u0432\u043b\u0438\u0432\u0430\u0435\u043c \u0438 \u0443\u0431\u0438\u0432\u0430\u0435\u043c \u0432\u0441\u0435 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u044b \u043d\u0430\u0448\u0435\u0433\u043e \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f: docker-compose down \u0435\u0441\u043b\u0438 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u043e\u0432 \u043c\u043d\u043e\u0433\u043e, \u0438 \u043e\u043d\u0438 \u0432","og:url":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/istoriya-problemy-perenosa-docker-storage-docker-root","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:13:26+00:00","article:modified_time":"2019-10-31T19:13:26+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"36736","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-22 04:38:20","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 01:39:24","updated":"2026-01-22 04:38:20"},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/36736","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=36736"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/36736\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=36736"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=36736"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=36736"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}