{"id":36736,"date":"2019-10-31T22:13:26","date_gmt":"2019-10-31T19:13:26","guid":{"rendered":"https:\/\/prohoster.info\/blog\/istoriya-problemy-perenosa-docker-storage-docker-root\/"},"modified":"2019-10-31T22:13:26","modified_gmt":"2019-10-31T19:13:26","slug":"istoriya-problemy-perenosa-docker-storage-docker-root","status":"publish","type":"post","link":"https:\/\/prohoster.info\/lv\/blog\/administrirovanie\/istoriya-problemy-perenosa-docker-storage-docker-root","title":{"rendered":"Probl\u0113mas v\u0113sture ar docker kr\u0101tuves p\u0101rvieto\u0161anu (docker root)","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Pirms da\u017e\u0101m dien\u0101m tika nolemts k\u0101d\u0101 no serveriem iznest docker uzglab\u0101\u0161anu (katalogs, kur docker uzglab\u0101 visus konteineru un att\u0113lu failus) atsevi\u0161\u0137\u0101 nodal\u012bjum\u0101, kam
\nbija liel\u0101ka ietilp\u012bba. Uzdevums, \u0161\u0137iet, ir vienk\u0101r\u0161s un nenoz\u012bm\u0113 briesmas...
\n<\/a><\/noindex>
\nS\u0101kam:<\/p>\n

1. Apturam un izn\u012bcin\u0101m visus m\u016bsu lietojumprogrammas konteinerus: <\/p>\n

docker-compose down<\/code><\/pre>\n
\nja konteineru ir daudz un tie ir da\u017e\u0101d\u0101s kompoz\u012bcij\u0101s, var dar\u012bt t\u0101: <\/p>\n
docker rm -f $(docker ps -q)<\/code><\/pre>\n
\n2. Apturam docker demon: <\/p>\n
systemctl stop docker<\/code><\/pre>\n
\n3. P\u0101rvietojam katalogu vajadz\u012bgaj\u0101 viet\u0101: <\/p>\n
cp -r \/var\/lib\/docker \/docker\/data\/storage<\/code><\/pre>\n
\n4. Pazi\u0146ojam docker demonam, lai tas skat\u012btos jaunaj\u0101 direktorij\u0101. \u0160eit ir vair\u0101ki varianti: vai nu caur atsl\u0113gu -g nor\u0101d\u012bt demonam jauno ce\u013cu, vai ar\u012b izmantot systemd konfigur\u0101cijas, kuras m\u0113s izmantoj\u0101m. Vai ar\u012b simbolisko saiti. Negribu to \u013coti izkl\u0101st\u012bt, internet\u0101 ir pilns<\/a><\/noindex> rokasgr\u0101matu par docker saknes p\u0101rvieto\u0161anu uz jaunu vietu.<\/p>\n
5. S\u0101kam docker demon, un nov\u0113rojam, lai tas skat\u012btos tur, kur vajag: <\/p>\n
systemctl status docker<\/code><\/pre>\n
\nVien\u0101 no izsnieguma rind\u0101m mums j\u0101redz:<\/p>\n
\u251c\u250019493 \/usr\/bin\/dockerd --data-root=\/docker\/data\/storage<\/code><\/pre>\n
\nP\u0101rliecin\u0101j\u0101mies, ka demonam nodota opcija, tagad p\u0101rbaud\u012bsim, vai t\u0101 tika piem\u0113rota (paldies inkvizitor68sl<\/a><\/noindex>)!<\/p>\n
docker info | awk '\/Root Dir\/ {print $NF}' <\/code><\/pre>\n
\n6. S\u0101kam m\u016bsu lietojumprogrammu: <\/p>\n
docker-compose up -d<\/code><\/pre>\n
\n7. P\u0101rbaud\u0101m<\/p>\n
Un te s\u0101kas visinteresant\u0101k\u0101 da\u013ca, DB, MQ, viss k\u0101rt\u012bb\u0101! Datu b\u0101ze ir vesela, viss str\u0101d\u0101\u2026 iz\u0146emot nginx. Mums ir sava nginx versija ar Kerberos un kurtiz\u0101n\u0113m. Un konteineru \u017eurn\u0101la apskate nor\u0101d\u012bja, ka tas nevar rakst\u012bt \/var\/tmp \u2014 At\u013cauja atteikta. Izstaip\u0101s pirksti un m\u0113\u0123inu analiz\u0113t situ\u0101ciju\u2026 K\u0101 t\u0101 var b\u016bt? Docker att\u0113ls ta\u010du nemain\u012bj\u0101s. M\u0113s vienk\u0101r\u0161i p\u0101rvietoj\u0101m direktoriju. Vienm\u0113r str\u0101d\u0101ja, un te p\u0113k\u0161\u0146i\u2026 Eksperimenta p\u0113c ieg\u0101ju konteiner\u0101 un main\u012bju \u0161o katalogu ties\u012bbas, bija root, root 755<\/u>, devu root, root 777<\/u>. Un viss s\u0101k\u0101s\u2026 Pr\u0101t\u0101 izskan\u0113ja doma \u2014 d\u012bvaini\u2026 Dom\u0101ju, nu varb\u016bt kaut ko neesmu \u0146\u0113mis v\u0113r\u0101... <\/p>\n
Izlemu, ka m\u0113s esam zaud\u0113ju\u0161i piek\u013cuves ties\u012bbas faili p\u0101rvieto\u0161anas laik\u0101. Aptur\u0113j\u0101m lietojumprogrammu, docker demon, izdz\u0113s\u0101m jaunizveidoto direktoriju un veic\u0101m kop\u0113\u0161anu no direktorijas \/var\/lib\/docker jau izmantojot rsync -a<\/code>. <\/p>\n
Dom\u0101ju, tagad noteikti viss ir k\u0101rt\u012bb\u0101, pacelam docker, lietojumprogrammu.<\/p>\n
Un... probl\u0113ma palika... Man acs s\u0101kusi raust\u012bties. Es steidzos uz savas virtu\u0101l\u0101s ma\u0161\u012bnas konsoli, kur veicu da\u017e\u0101dus testus, man bija \u0161is nginx att\u0113ls, un es iek\u013cuvu konteinera iek\u0161ien\u0113, un tad \/var\/tmp katalogam ir ties\u012bbas root, root 777. T\u0101s ir pa\u0161as, k\u0101das man n\u0101c\u0101s uzst\u0101d\u012bt manu\u0101li. Bet att\u0113li ta\u010du ir identiski! <\/p>\n
Visur tika izmantota xfs failu sist\u0113ma.<\/u><\/p>\n
Es sal\u012bdzin\u0101ju ar komandu <\/p>\n
docker inspect my-nginx:12345<\/code><\/pre>\n
\nVisas hash v\u0113rt\u012bbas ir identiskas, viss ir viens uz vienu. Gan uz servera, gan man\u0101 virtu\u0101laj\u0101 ma\u0161\u012bn\u0101. Es izdz\u0113su viet\u0113jo nginx att\u0113lu un atk\u0101rtoti to ielaidu no re\u0123istra, kur\u0161 da\u017e\u0101du iemeslu d\u0113\u013c atrodas uz t\u0101s pa\u0161as ma\u0161\u012bnas. Un probl\u0113ma ir t\u0101da pati... Tagad man s\u0101ka raust\u012bties otra acs.<\/p>\n
Es jau neatceros, k\u0101das domas bija man\u0101 galv\u0101, iz\u0146emot saucienus \u00abAAAAAA\u00bb un visu p\u0101r\u0113jo. Ieliku tre\u0161o ener\u0123ijas dz\u0113riena bund\u017eu. Un beidzot sapratu, ka hash\u0113\u0161ana \u0146em v\u0113r\u0101 tikai failu, t\u0101 saturu, bet NE TIES\u012aBAS<\/b>! T\u0101tad, kaut k\u0101d\u0101 nosl\u0113pumain\u0101 veid\u0101 m\u016bsu ties\u012bbas tika salauztas, turkl\u0101t selinux ir izsl\u0113gts, acl nav izmantots, sticky bit nav. <\/p>\n
Es izdz\u0113su viet\u0113jo att\u0113lu, ar\u012b izdz\u0113su att\u0113lu no docker re\u0123istra un nospiedu to atk\u0101rtoti. Un viss s\u0101ka str\u0101d\u0101t. Izr\u0101d\u0101s, ka p\u0101rvieto\u0161anas laik\u0101 ties\u012bbas tika salauztas, gan viet\u0113j\u0101 att\u0113l\u0101, gan att\u0113l\u0101, kas atrodas re\u0123istr\u0101. K\u0101 jau teicu, da\u017e\u0101du iemeslu d\u0113\u013c tas atrad\u0101s uz t\u0101s pa\u0161as ma\u0161\u012bnas. Un k\u0101 sekas vien\u0101 katalog\u0101 \/var\/lib\/docker.<\/p>\n
Un, gaidot jaut\u0101jumu, vai esmu m\u0113\u0123in\u0101jis atgriezt docker uz veco katalogu \u2014 n\u0113, neesmu m\u0113\u0123in\u0101jis, diem\u017e\u0113l apst\u0101k\u013ci to ne\u013c\u0101va. Un ar\u012b \u013coti grib\u0113j\u0101s izprast situ\u0101ciju.<\/p>\n
P\u0113c \u0161\u012b raksta uzrakst\u012b\u0161anas man risin\u0101jums \u0161\u0137iet ac\u012bmredzams, bet br\u012bd\u012b, kad to risin\u0101ju, tas t\u0101ds ne\u0161\u0137ita. God\u012bgi mekl\u0113ju internet\u0101 un neatradu l\u012bdz\u012bgas situ\u0101cijas.<\/p>\n
Rezult\u0101ts: probl\u0113mu atrisin\u0101ju, bet iemeslu t\u0101 ar\u012b nesapratu =(<\/p>\n
Ja k\u0101ds zina, nojau\u0161, bija idejas par iesp\u0113jamajiem \u0161\u012bs probl\u0113mas c\u0113lo\u0146iem \u2014 es b\u016b\u0161u \u013coti priec\u012bgs par koment\u0101riem!
\n
Avots: habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"
\u041d\u0435 \u0434\u0430\u043b\u0435\u0435, \u0447\u0435\u043c \u043f\u0430\u0440\u0443 \u0434\u043d\u0435\u0439 \u043d\u0430\u0437\u0430\u0434 \u0431\u044b\u043b\u043e \u0440\u0435\u0448\u0435\u043d\u043e \u043d\u0430 \u043e\u0434\u043d\u043e\u043c \u0438\u0437 \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432 \u0432\u044b\u043d\u0435\u0441\u0442\u0438 docker storage (\u043a\u0430\u0442\u0430\u043b\u043e\u0433, \u0433\u0434\u0435 \u0434\u043e\u043a\u0435\u0440 \u0445\u0440\u0430\u043d\u0438\u0442 \u0432\u0441\u0435 \u0444\u0430\u0439\u043b\u044b \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u043e\u0432, \u043e\u0431\u0440\u0430\u0437\u043e\u0432) \u043d\u0430 \u043e\u0442\u0434\u0435\u043b\u044c\u043d\u044b\u0439 \u0440\u0430\u0437\u0434\u0435\u043b, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043e\u0431\u043b\u0430\u0434\u0430\u043b \u0431\u043e\u043b\u044c\u0448\u0435\u0439 \u0435\u043c\u043a\u043e\u0441\u0442\u044c\u044e. \u0417\u0430\u0434\u0430\u0447\u0430, \u043a\u0430\u0437\u0430\u043b\u043e\u0441\u044c \u0431\u044b, \u0442\u0440\u0438\u0432\u0438\u0430\u043b\u044c\u043d\u0430\u044f \u0438 \u043d\u0435 \u043f\u0440\u0435\u0434\u0432\u0435\u0449\u0430\u043b\u0430 \u0431\u0435\u0434\u044b\u2026 \u041f\u0440\u0438\u0441\u0442\u0443\u043f\u0430\u0435\u043c: 1. \u041e\u0441\u0442\u0430\u043d\u0430\u0432\u043b\u0438\u0432\u0430\u0435\u043c \u0438 \u0443\u0431\u0438\u0432\u0430\u0435\u043c \u0432\u0441\u0435 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u044b \u043d\u0430\u0448\u0435\u0433\u043e \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f: docker-compose down \u0435\u0441\u043b\u0438 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u043e\u0432 \u043c\u043d\u043e\u0433\u043e, \u0438 \u043e\u043d\u0438 \u0432 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-36736","post","type-post","status-publish","format-standard","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Probl\u0113mas par docker storage (docker root) p\u0101rvieto\u0161anu st\u0101sts | ProHoster","description":"Nepag\u0101ja ne divas dienas, kad tika nolemts vien\u0101 no serveriem iznest docker storage (katalogs, kur docker glab\u0101 visu konteineru, att\u0113lu failus) uz atsevi\u0161\u0137as part\u012bcijas, kurai bija liel\u0101ka ietilp\u012bba.","canonical_url":"https:\/\/prohoster.info\/lv\/blog\/administrirovanie\/istoriya-problemy-perenosa-docker-storage-docker-root","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"lv_LV","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0418\u0441\u0442\u043e\u0440\u0438\u044f \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u043f\u0435\u0440\u0435\u043d\u043e\u0441\u0430 docker storage (docker root) | ProHoster","og:description":"\u041d\u0435 \u0434\u0430\u043b\u0435\u0435, \u0447\u0435\u043c \u043f\u0430\u0440\u0443 \u0434\u043d\u0435\u0439 \u043d\u0430\u0437\u0430\u0434 \u0431\u044b\u043b\u043e \u0440\u0435\u0448\u0435\u043d\u043e \u043d\u0430 \u043e\u0434\u043d\u043e\u043c \u0438\u0437 \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432 \u0432\u044b\u043d\u0435\u0441\u0442\u0438 docker storage (\u043a\u0430\u0442\u0430\u043b\u043e\u0433, \u0433\u0434\u0435 \u0434\u043e\u043a\u0435\u0440 \u0445\u0440\u0430\u043d\u0438\u0442 \u0432\u0441\u0435 \u0444\u0430\u0439\u043b\u044b \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u043e\u0432, \u043e\u0431\u0440\u0430\u0437\u043e\u0432) \u043d\u0430 \u043e\u0442\u0434\u0435\u043b\u044c\u043d\u044b\u0439 \u0440\u0430\u0437\u0434\u0435\u043b, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043e\u0431\u043b\u0430\u0434\u0430\u043b \u0431\u043e\u043b\u044c\u0448\u0435\u0439 \u0435\u043c\u043a\u043e\u0441\u0442\u044c\u044e.","og:url":"https:\/\/prohoster.info\/lv\/blog\/administrirovanie\/istoriya-problemy-perenosa-docker-storage-docker-root","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:13:26+00:00","article:modified_time":"2019-10-31T19:13:26+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"36736","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-22 04:38:20","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 01:39:24","updated":"2026-01-22 04:38:20","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/posts\/36736","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/comments?post=36736"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/posts\/36736\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/media?parent=36736"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/categories?post=36736"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/tags?post=36736"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}