{"id":36736,"date":"2019-10-31T22:13:26","date_gmt":"2019-10-31T19:13:26","guid":{"rendered":"https:\/\/prohoster.info\/blog\/istoriya-problemy-perenosa-docker-storage-docker-root\/"},"modified":"2019-10-31T22:13:26","modified_gmt":"2019-10-31T19:13:26","slug":"istoriya-problemy-perenosa-docker-storage-docker-root","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/istoriya-problemy-perenosa-docker-storage-docker-root","title":{"rendered":"Docker storage (docker root) \u00fcleviimise probleemide ajalugu","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

M\u00f5ni p\u00e4ev tagasi otsustati \u00fchel serveril viia docker storage (kataloog, kus docker salvestab k\u00f5ik konteineri failid ja pildid) eraldi partitsioonile, mis
\noli suurema mahtuvusega. \u00dclesanne n\u00e4is triviaalne ja ei lubanud halba...
\n<\/a><\/noindex>
\nAlustame:<\/p>\n

1. Peatame ja tapame k\u00f5ik meie rakenduse konteinerid: <\/p>\n

docker-compose down<\/code><\/pre>\n
\nkui konteinerite arv on suur ja need on erinevates compose failides, v\u00f5ib kasutada j\u00e4rgmist: <\/p>\n
docker rm -f $(docker ps -q)<\/code><\/pre>\n
\n2. Peatame docker deemon: <\/p>\n
systemctl stop docker<\/code><\/pre>\n
\n3. Liigume katalooge soovitud asukohta: <\/p>\n
cp -r \/var\/lib\/docker \/docker\/data\/storage<\/code><\/pre>\n
\n4. Anname docker deemonile teada, et see vaataks uude kausta. Siin on mitu varianti: kas m\u00e4\u00e4rata deemonile uus tee -g flagi kaudu, v\u00f5i kasutada systemd konforme, mida me ka kasutasime. V\u00f5i s\u00fcmboolsed lingid. Ei hakka seda liiga palju lahti kirjutama, internetis on palju<\/a><\/noindex> k\u00e4siraamatuid docker juure uude kohta viimise kohta.<\/p>\n
5. K\u00e4ivitame docker deemonit ja j\u00e4lgime, et see vaataks \u00f5iges suunas: <\/p>\n
systemctl status docker<\/code><\/pre>\n
\n\u00dches v\u00e4ljundi real peaksime n\u00e4gema:<\/p>\n
\u251c\u250019493 \/usr\/bin\/dockerd --data-root=\/docker\/data\/storage<\/code><\/pre>\n
\nVeendume, et deemon sai valiku jaotuse, n\u00fc\u00fcd kontrollime, kas ta kasutas seda (t\u00e4nud inkvizitor68sl<\/a><\/noindex>)!<\/p>\n
docker info | awk '\/Root Dir\/ {print $NF}' <\/code><\/pre>\n
\n6. K\u00e4ivitame meie rakenduse: <\/p>\n
Vaatame lihtsat n\u00e4idet.<\/code><\/pre>\n
\n7. Kontrollime<\/p>\n
Ja n\u00fc\u00fcd algab k\u00f5ige huvitavam osa, DB, MQ, k\u00f5ik on h\u00e4sti! Andmebaas on terve, k\u00f5ik t\u00f6\u00f6tab... v\u00e4lja arvatud nginx. Meil on oma nginx kogum, millel on kerberos ja eskortt\u00fctred. Ja konteineri logide vaatamine n\u00e4itas, et ta ei saa kirjutada \/var\/tmp \u2014 Permission denied. Katisin s\u00f5rmi ja proovin olukorda anal\u00fc\u00fcsida... Kuidas nii? Docker image ei muutunud. Lihtsalt liikusime kausta. Alati on t\u00f6\u00f6tanud ja n\u00fc\u00fcd... Eksperimendi nimel l\u00e4ksin k\u00e4sitsi konteinerisse ja muutsin \u00f5igusi antud katalooge, need olid root, root 755<\/u>, muutsin need root, root 777<\/u>. Ja k\u00f5ik hakkas t\u00f6\u00f6le... Peas kajas m\u00f5te \u2014 mingi jama see ju on... M\u00f5tlesin, et ehk ei pidanud ma midagi silmas... <\/p>\n
Otsustasin, et me kaotasime failide \u00f5igused kaustade liigutamise ajal. Peatasime rakenduse, docker deemoni, eemaldasime uue kausta ja sooritasime \/var\/lib\/docker kausta kopeerimise, kasutades rsync -a<\/code>. <\/p>\n
M\u00f5tlesin, et n\u00fc\u00fcd on kindlasti k\u00f5ik h\u00e4sti, k\u00e4ivitame dockeri, rakenduse.<\/p>\n
Nii... probleem j\u00e4i alles... Mul hakkas silm t\u00f5mblema. Ma kiirustasin oma virtuaalmasina konsooli, kus jooksutan erinevaid teste. Mul oli see nginx'i pilt ja ma ronisin konteinerisse, ning seal kataloogis \/var\/tmp olid \u00f5igused root, root 777. Seega olid \u00f5igused samad, mida pidin k\u00e4sitsi seadma. Kuid pildid on ju identsed! <\/p>\n
Iga pool kasutati FS xfs.<\/u><\/p>\n
V\u00f5rdlesin k\u00e4su kaudu <\/p>\n
docker inspect my-nginx:12345<\/code><\/pre>\n
\nK\u00f5ik hashid on identsed, k\u00f5ik on \u00fchesugused. Nii serveris kui ka minu virtuaalmasinas. Kustutasin kohalikku nginx'i pilti ja t\u00f5mbasin selle uuesti registry'lt, mis mitmel p\u00f5hjusel asub samal masinal. Ja probleem on sama... N\u00fc\u00fcd t\u00f5mbles mul teine silm.<\/p>\n
Ma ei m\u00e4leta, millised m\u00f5tted olid mu peas, v\u00e4lja arvatud karjed 'AAAAAA' ja muud. V\u00e4ljas on kell neli hommikul, haarasin Docker'i l\u00e4htekoodid, et m\u00f5ista pildi kihtide hashimise p\u00f5him\u00f5tet. Avatud kolmas energiajoogipurk. L\u00f5puks j\u00f5udsin kohale, et hashimine arvestab ainult faili ja selle sisu, kuid EI OLE \u00d5IGUSI<\/b>! Nii et mingil salap\u00e4rasel moel on meie \u00f5igused rikutud, kuigi selinux on v\u00e4lja l\u00fclitatud, acl ei kasutata, sticky bit ei ole. <\/p>\n
Kustutasin kohaliku pildi, eemaldas sama pildi docker registrist ja pushisin uuesti. Ja k\u00f5ik hakkas t\u00f6\u00f6le. Tundub, et \u00f5igus on rikutud nii kohalikus pildis kui ka registris asuvas pildis. Nagu ma juba \u00fctlesin, asus see mitmel p\u00f5hjusel samas masinas. Ja seet\u00f5ttu \u00fches kataloogis \/var\/lib\/docker.<\/p>\n
Ootasin k\u00fcsimust, kas ollakse proovinud Docker'i silm tagasi vanasse kataloogi suunata \u2014 ei, me ei proovinud, kahjuks ei lubanud asjaolud. Ja tore oli aru saada.<\/p>\n
Selle artikli kirjutamise j\u00e4rel tundub mulle selle probleemi lahendus ilmne, kuid selle anal\u00fc\u00fcsi hetkel ei tundunud see nii. Ausalt otsisin ja ei leidnud sarnaseid olukordi.<\/p>\n
Kokkuv\u00f5te: probleem lahendatud, p\u00f5hjust ma ei m\u00f5istnud =(<\/p>\n
Kui keegi teab v\u00f5i kahtlustab v\u00f5imalikke p\u00f5hjuseid, miks see probleem tekkis \u2014 oleksin v\u00e4ga t\u00e4nulik kommentaarides!
\n
Allikas: habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"
\u041d\u0435 \u0434\u0430\u043b\u0435\u0435, \u0447\u0435\u043c \u043f\u0430\u0440\u0443 \u0434\u043d\u0435\u0439 \u043d\u0430\u0437\u0430\u0434 \u0431\u044b\u043b\u043e \u0440\u0435\u0448\u0435\u043d\u043e \u043d\u0430 \u043e\u0434\u043d\u043e\u043c \u0438\u0437 \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432 \u0432\u044b\u043d\u0435\u0441\u0442\u0438 docker storage (\u043a\u0430\u0442\u0430\u043b\u043e\u0433, \u0433\u0434\u0435 \u0434\u043e\u043a\u0435\u0440 \u0445\u0440\u0430\u043d\u0438\u0442 \u0432\u0441\u0435 \u0444\u0430\u0439\u043b\u044b \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u043e\u0432, \u043e\u0431\u0440\u0430\u0437\u043e\u0432) \u043d\u0430 \u043e\u0442\u0434\u0435\u043b\u044c\u043d\u044b\u0439 \u0440\u0430\u0437\u0434\u0435\u043b, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043e\u0431\u043b\u0430\u0434\u0430\u043b \u0431\u043e\u043b\u044c\u0448\u0435\u0439 \u0435\u043c\u043a\u043e\u0441\u0442\u044c\u044e. \u0417\u0430\u0434\u0430\u0447\u0430, \u043a\u0430\u0437\u0430\u043b\u043e\u0441\u044c \u0431\u044b, \u0442\u0440\u0438\u0432\u0438\u0430\u043b\u044c\u043d\u0430\u044f \u0438 \u043d\u0435 \u043f\u0440\u0435\u0434\u0432\u0435\u0449\u0430\u043b\u0430 \u0431\u0435\u0434\u044b\u2026 \u041f\u0440\u0438\u0441\u0442\u0443\u043f\u0430\u0435\u043c: 1. \u041e\u0441\u0442\u0430\u043d\u0430\u0432\u043b\u0438\u0432\u0430\u0435\u043c \u0438 \u0443\u0431\u0438\u0432\u0430\u0435\u043c \u0432\u0441\u0435 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u044b \u043d\u0430\u0448\u0435\u0433\u043e \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f: docker-compose down \u0435\u0441\u043b\u0438 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u043e\u0432 \u043c\u043d\u043e\u0433\u043e, \u0438 \u043e\u043d\u0438 \u0432 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-36736","post","type-post","status-publish","format-standard","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Docker'i salvestuse (Docker root) \u00fcleviimise probleemide ajalugu | ProHoster","description":"Kaks p\u00e4eva tagasi otsustati \u00fchel serveril viia Docker'i salvestus (kataloog, kuhu Docker salvestab k\u00f5ik konteinerite ja piltide failid) eraldi partitsioonile, millel on suurem maht.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/istoriya-problemy-perenosa-docker-storage-docker-root","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0418\u0441\u0442\u043e\u0440\u0438\u044f \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u043f\u0435\u0440\u0435\u043d\u043e\u0441\u0430 docker storage (docker root) | ProHoster","og:description":"\u041d\u0435 \u0434\u0430\u043b\u0435\u0435, \u0447\u0435\u043c \u043f\u0430\u0440\u0443 \u0434\u043d\u0435\u0439 \u043d\u0430\u0437\u0430\u0434 \u0431\u044b\u043b\u043e \u0440\u0435\u0448\u0435\u043d\u043e \u043d\u0430 \u043e\u0434\u043d\u043e\u043c \u0438\u0437 \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432 \u0432\u044b\u043d\u0435\u0441\u0442\u0438 docker storage (\u043a\u0430\u0442\u0430\u043b\u043e\u0433, \u0433\u0434\u0435 \u0434\u043e\u043a\u0435\u0440 \u0445\u0440\u0430\u043d\u0438\u0442 \u0432\u0441\u0435 \u0444\u0430\u0439\u043b\u044b \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u043e\u0432, \u043e\u0431\u0440\u0430\u0437\u043e\u0432) \u043d\u0430 \u043e\u0442\u0434\u0435\u043b\u044c\u043d\u044b\u0439 \u0440\u0430\u0437\u0434\u0435\u043b, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043e\u0431\u043b\u0430\u0434\u0430\u043b \u0431\u043e\u043b\u044c\u0448\u0435\u0439 \u0435\u043c\u043a\u043e\u0441\u0442\u044c\u044e.","og:url":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/istoriya-problemy-perenosa-docker-storage-docker-root","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:13:26+00:00","article:modified_time":"2019-10-31T19:13:26+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"36736","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-22 04:38:20","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 01:39:24","updated":"2026-01-22 04:38:20","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/36736","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=36736"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/36736\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=36736"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=36736"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=36736"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}