在Docker容器中运行时，JVM不能映射保留的内存 [英] JVM cant map reserved memory when running in Docker container

问题描述

我不能在我的服务器上的Docker容器中运行java。即使发行 java -version ，我收到以下错误。

  root @ 86088d679103：/＃java -version 
 OpenJDK 64位服务器VM警告：INFO：os :: commit_memory（0x0000035ce1000000,2555904,1）失败; error ='不允许操作'（errno = 1）
＃
＃Java运行时环境的内存不足。 
＃本地内存分配（mmap）无法映射2555904个字节提交保留内存。 
＃具有更多信息的错误报告文件保存为：
＃//hs_err_pid17.log 
  

据此，java不能映射2.5Mb的空间用于保留内存？这似乎不正确...

我的完整日志包含在最后，但为了一些额外的信息，我的系统报告以下内容： / p>

  root @ 86088d679103：/＃uname -m 
 x86_64 
 root @ 86088d679103：/＃free -mh 
总共使用免费共享缓冲区缓存
内存：15G 9.7G 5.8G 912K 148M 8.9G 
  -  / +缓冲区/缓存：639M 14G 
交换：15G 0B 15G 
  

任何人都可以指向正确的方向吗？

完整日志： https：//gist.github .com / KayoticSully / e206c44681ce261674ba

更新

@Yobert确定了问题，我强烈建议您阅读评论和聊天记录。

对于那些希望使Java工作的最终命令的人： setfattr -n user.pax.flags -vmr / usr / bin / java

如果您的发行版没有安装 setfattr 默认情况下，它应该通过paceman，apt-get等包含在可安装的包中。

解决方案

我有同样的问题当使用启用Grsec的内核时。对于java玩的好，我不得不禁用MPROTECT上的java二进制文件。您可以使用 paxctl 实用程序：

  paxctl -m / usr / lib / jvm / java-7-openjdk / jre / bin / java 
  

如果您之前从未使用该二进制文件，则可以先对二进制进行 paxctl -c ：

  paxctl -c / usr / lib / jvm / java-7-openjdk / jre / bin / java 
  

有关paxctl的更多信息，请参见： http：// en .wikibooks.org / wiki / Grsecurity / Additional_Utilities

I cant seem to run java at all in a Docker container on my server. Even when issuing java -version, I get the following error.

root@86088d679103:/# java -version
OpenJDK 64-Bit Server VM warning: INFO: os::commit_memory(0x0000035ce1000000, 2555904, 1) failed; error='Operation not permitted' (errno=1)
#
# There is insufficient memory for the Java Runtime Environment to continue.
# Native memory allocation (mmap) failed to map 2555904 bytes for committing reserved memory.
# An error report file with more information is saved as:
# //hs_err_pid17.log

According to this, java can't map 2.5Mb of space for reserved memory? This does not seem right...

I have the full log included at the end, but for the sake of some extra information, my system is reporting the following:

root@86088d679103:/# uname -m
x86_64
root@86088d679103:/# free -mh
             total       used       free     shared    buffers     cached
Mem:           15G       9.7G       5.8G       912K       148M       8.9G
-/+ buffers/cache:       639M        14G
Swap:          15G         0B        15G

Can anyone point me in the right direction?

Full Log: https://gist.github.com/KayoticSully/e206c44681ce261674ba

Update

@Yobert nailed the problem and I highly suggest you read through the comments and chat log. Good info in there.

For those who want the final command that made Java work: setfattr -n user.pax.flags -v "mr" /usr/bin/java

If your distro does not have setfattr installed by default it should be included in the installable package attr through paceman, apt-get, etc.

解决方案

I had this same problem when using a Grsec enabled kernel. For java to play nice, I had to disable MPROTECT on the java binary. You can use the paxctl utility for this:

paxctl -m /usr/lib/jvm/java-7-openjdk/jre/bin/java

You'll need to do paxctl -c on the binary first if you've never used it on that binary before:

paxctl -c /usr/lib/jvm/java-7-openjdk/jre/bin/java

More information about paxctl can be found at: http://en.wikibooks.org/wiki/Grsecurity/Additional_Utilities

这篇关于在Docker容器中运行时，JVM不能映射保留的内存的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！