{"id":36736,"date":"2019-10-31T22:13:26","date_gmt":"2019-10-31T19:13:26","guid":{"rendered":"https:\/\/prohoster.info\/blog\/istoriya-problemy-perenosa-docker-storage-docker-root\/"},"modified":"2019-10-31T22:13:26","modified_gmt":"2019-10-31T19:13:26","slug":"istoriya-problemy-perenosa-docker-storage-docker-root","status":"publish","type":"post","link":"https:\/\/prohoster.info\/hr\/blog\/administrirovanie\/istoriya-problemy-perenosa-docker-storage-docker-root","title":{"rendered":"Povijest problema s prijenosom docker storage (docker root)","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Prije nekoliko dana odlu\u010deno je da se na jednom od servera Docker storage (direktorij gdje Docker pohranjuje sve datoteke kontejnera i slika) premjesti na zaseban dio s ve\u0107im kapacitetom. Zadatak se \u010dinilo trivijalnim i nije predodre\u0111ivao nevolje...
\nZapo\u010dinjemo:
\n<\/a><\/noindex>
\n1. Zaustavljamo i ubijamo sve kontejnere na\u0161e aplikacije:<\/p>\n

Ako ima puno kontejnera i nalaze se u razli\u010ditim compose datotekama, to mo\u017eemo u\u010diniti ovako: <\/p>\n

docker-compose down<\/code><\/pre>\n
\ndocker rm -f $(docker ps -q) <\/p>\n
2. Zaustavljamo Docker demon:<\/code><\/pre>\n
\nsystemctl stop docker <\/p>\n
3. Premje\u0161tamo direktorij na \u017eeljeno mjesto:<\/code><\/pre>\n
\ncp -r \/var\/lib\/docker \/docker\/data\/storage <\/p>\n
4. Obavje\u0161tavamo Docker demona da gleda u novi direktorij. Ima nekoliko opcija: ili putem zastavice -g nazna\u010dimo demonu novi put, ili koristimo systemd konfiguracije, \u0161to smo mi i u\u010dinili. Ili simboli\u010dki link. Ne\u0107u previ\u0161e obja\u0161njavati, na internetu<\/code><\/pre>\n
\nima dosta<\/a><\/noindex> priru\u010dnika o premje\u0161tanju docker root-a na novo mjesto.<\/p>\n
5. Pokre\u0107emo Docker demona i promatramo da gleda kamo treba: <\/p>\n
systemctl status docker<\/code><\/pre>\n
\nU jednom od redova izlaza trebali bismo vidjeti:<\/p>\n
\u251c\u250019493 \/usr\/bin\/dockerd --data-root=\/docker\/data\/storage<\/code><\/pre>\n
\nProvjerili smo da je demonu proslije\u0111ena opcija, sada \u0107emo provjeriti je li je primijenio (hvala inkvizitor68sl<\/a><\/noindex>)!<\/p>\n
docker info | awk '\/Root Dir\/ {print $NF}' <\/code><\/pre>\n
\n6. Pokre\u0107emo na\u0161u aplikaciju: <\/p>\n
docker-compose up -d<\/code><\/pre>\n
\n7. Provjeravamo<\/p>\n
I ovdje po\u010dinje najzanimljiviji dio, SGBD, MQ, sve je u redu! Baza je netaknuta, sve radi... osim nginx-a. Imamo vlastitu verziju nginx-a s Kerberosom i kurti\u017eankama. Pregled logova kontejnera pokazao je da ne mo\u017ee pisati u \/var\/tmp \u2014 Permission denied. Zategnem prste i poku\u0161avam analizirati situaciju\u2026 Kako to? Docker slika se nije mijenjala. Samo smo premjestili direktorij. Oduvijek je radilo, i sada\u2026 Iz eksperimenta sam ru\u010dno u\u0161ao u kontejner i promijenio dozvole za taj direktorij, bile su root, root 755<\/u>, postavio sam root, root 777<\/u>. I sve je proradilo\u2026 U glavi se javila misao \u2014 kakva glupost\u2026 Mislio sam, mo\u017eda nisam ne\u0161to uzeo u obzir\u2026 <\/p>\n
Odlu\u010dio sam da smo izgubili dozvole na datotekama prilikom premje\u0161tanja. Zaustavili smo aplikaciju, Docker demona, izbrisali novu direktorij i ponovno kopirali direktorij \/var\/lib\/docker koriste\u0107i rsync -a<\/code>. <\/p>\n
Mislim, sada je sigurno sve u redu, pokre\u0107emo Docker, aplikaciju.<\/p>\n
I\u2026 the problem remains\u2026 My eye twitched. I rushed to the console of my virtual machine, where I run various tests, I had this nginx image, and I accessed the container, and here in the directory \/var\/tmp, the permissions are root, root 777. That is, the same ones I had to set manually. But the images are identical! <\/p>\n
The xfs filesystem was used everywhere.<\/u><\/p>\n
I compared it using the command <\/p>\n
docker inspect my-nginx:12345<\/code><\/pre>\n
\nAll hashes are identical, all exactly the same. On the server and on my virtual machine. I deleted the local nginx image and pulled it again from the registry, which for various reasons is on the same machine. And the problem remains\u2026 Now my second eye twitched.<\/p>\n
I no longer remember what thoughts were in my head, apart from screams of \u201cAAAAAAA\u201d and the like. It\u2019s 4 AM outside, and the docker sources were needed to understand the principles of image layer hashing. I opened the third can of energy drink. And in the end, it dawned on me that hashing only considers the file, its contents, but NO ACCESS RIGHTS<\/b>! That is, for some mysterious reason, our permissions were messed up, although selinux is disabled, acl is not used, and there is no sticky bit. <\/p>\n
I deleted the local image, also removed the image from the docker registry and pushed it again. And everything worked. It turns out that during the transfer, the permissions were messed up, both inside the local image and inside the image stored in the registry. As I mentioned, for various reasons it was located on the same machine. And consequently in the same directory \/var\/lib\/docker.<\/p>\n
And anticipating the question, whether we tried to return docker's gaze to the old directory \u2014 no, we didn\u2019t, unfortunately, circumstances did not allow it. And I really wanted to figure it out.<\/p>\n
After writing this article, the solution to the problem seems obvious to me, but at the time of troubleshooting, it did not seem so. Honestly googled, and did not find similar situations.<\/p>\n
Result: problem solved, the reason still not understood =(<\/p>\n
If someone knows or suspects any possible reasons for this problem \u2014 I would be extremely grateful in the comments!
\n
Izvor: habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"
\u041d\u0435 \u0434\u0430\u043b\u0435\u0435, \u0447\u0435\u043c \u043f\u0430\u0440\u0443 \u0434\u043d\u0435\u0439 \u043d\u0430\u0437\u0430\u0434 \u0431\u044b\u043b\u043e \u0440\u0435\u0448\u0435\u043d\u043e \u043d\u0430 \u043e\u0434\u043d\u043e\u043c \u0438\u0437 \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432 \u0432\u044b\u043d\u0435\u0441\u0442\u0438 docker storage (\u043a\u0430\u0442\u0430\u043b\u043e\u0433, \u0433\u0434\u0435 \u0434\u043e\u043a\u0435\u0440 \u0445\u0440\u0430\u043d\u0438\u0442 \u0432\u0441\u0435 \u0444\u0430\u0439\u043b\u044b \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u043e\u0432, \u043e\u0431\u0440\u0430\u0437\u043e\u0432) \u043d\u0430 \u043e\u0442\u0434\u0435\u043b\u044c\u043d\u044b\u0439 \u0440\u0430\u0437\u0434\u0435\u043b, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043e\u0431\u043b\u0430\u0434\u0430\u043b \u0431\u043e\u043b\u044c\u0448\u0435\u0439 \u0435\u043c\u043a\u043e\u0441\u0442\u044c\u044e. \u0417\u0430\u0434\u0430\u0447\u0430, \u043a\u0430\u0437\u0430\u043b\u043e\u0441\u044c \u0431\u044b, \u0442\u0440\u0438\u0432\u0438\u0430\u043b\u044c\u043d\u0430\u044f \u0438 \u043d\u0435 \u043f\u0440\u0435\u0434\u0432\u0435\u0449\u0430\u043b\u0430 \u0431\u0435\u0434\u044b\u2026 \u041f\u0440\u0438\u0441\u0442\u0443\u043f\u0430\u0435\u043c: 1. \u041e\u0441\u0442\u0430\u043d\u0430\u0432\u043b\u0438\u0432\u0430\u0435\u043c \u0438 \u0443\u0431\u0438\u0432\u0430\u0435\u043c \u0432\u0441\u0435 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u044b \u043d\u0430\u0448\u0435\u0433\u043e \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f: docker-compose down \u0435\u0441\u043b\u0438 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u043e\u0432 \u043c\u043d\u043e\u0433\u043e, \u0438 \u043e\u043d\u0438 \u0432 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-36736","post","type-post","status-publish","format-standard","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Story of the problem transferring docker storage (docker root) | ProHoster","description":"Just a couple of days ago, it was decided to move the docker storage (the directory where docker keeps all container files, images) to a separate partition with a larger capacity.","canonical_url":"https:\/\/prohoster.info\/hr\/blog\/administrirovanie\/istoriya-problemy-perenosa-docker-storage-docker-root","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"hr_HR","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0418\u0441\u0442\u043e\u0440\u0438\u044f \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u043f\u0435\u0440\u0435\u043d\u043e\u0441\u0430 docker storage (docker root) | ProHoster","og:description":"\u041d\u0435 \u0434\u0430\u043b\u0435\u0435, \u0447\u0435\u043c \u043f\u0430\u0440\u0443 \u0434\u043d\u0435\u0439 \u043d\u0430\u0437\u0430\u0434 \u0431\u044b\u043b\u043e \u0440\u0435\u0448\u0435\u043d\u043e \u043d\u0430 \u043e\u0434\u043d\u043e\u043c \u0438\u0437 \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432 \u0432\u044b\u043d\u0435\u0441\u0442\u0438 docker storage (\u043a\u0430\u0442\u0430\u043b\u043e\u0433, \u0433\u0434\u0435 \u0434\u043e\u043a\u0435\u0440 \u0445\u0440\u0430\u043d\u0438\u0442 \u0432\u0441\u0435 \u0444\u0430\u0439\u043b\u044b \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u043e\u0432, \u043e\u0431\u0440\u0430\u0437\u043e\u0432) \u043d\u0430 \u043e\u0442\u0434\u0435\u043b\u044c\u043d\u044b\u0439 \u0440\u0430\u0437\u0434\u0435\u043b, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043e\u0431\u043b\u0430\u0434\u0430\u043b \u0431\u043e\u043b\u044c\u0448\u0435\u0439 \u0435\u043c\u043a\u043e\u0441\u0442\u044c\u044e.","og:url":"https:\/\/prohoster.info\/hr\/blog\/administrirovanie\/istoriya-problemy-perenosa-docker-storage-docker-root","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:13:26+00:00","article:modified_time":"2019-10-31T19:13:26+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"36736","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-22 04:38:20","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 01:39:24","updated":"2026-01-22 04:38:20","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts\/36736","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/comments?post=36736"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts\/36736\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/media?parent=36736"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/categories?post=36736"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/tags?post=36736"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}