无法在装有/ etc / passwd和/ etc / shadow的docker容器中添加新用户 [英] Can not add new user in docker container with mounted /etc/passwd and /etc/shadow

问题描述

docker run -ti -v my_passwd:/etc/passwd -v my_shadow:/etc/shadow --rm centos
[root@681a5489f3b0 /]# useradd test # does not work !?
useradd: failure while writing changes to /etc/passwd
[root@681a5489f3b0 /]# ll /etc/passwd /etc/shadow # permission check
-rw-r--r-- 1 root root 157 Oct  8 10:17 /etc/passwd
-rw-r----- 1 root root 100 Oct  7 18:02 /etc/shadow

使用passwd时也会出现类似的问题：

The similar problem arises when using passwd:

[root@681a5489f3b0 /]# passwd test
Changing password for user test.
New password: 
BAD PASSWORD: The password is shorter than 8 characters
Retype new password: 
passwd: Authentication token manipulation error

我尝试过使用ubuntu映像，但是出现了同样的问题。

I have tried using the ubuntu image, but the same problem arises.

我可以手动在容器中编辑passwd文件和影子文件。

I can manually edit passwd file and shadow file from within container.

主机操作系统：CentOS 7-SELinux已禁用

Docker版本：1.8.2，build 0a8c2e3

Host OS: CentOS 7 - SELinux Disabled
Docker Version: 1.8.2, build 0a8c2e3

主机操作系统：CoreOS 766.4.0

Docker版本：1.7.1，构建df2f73d-dirty

Host OS: CoreOS 766.4.0
Docker version: 1.7.1, build df2f73d-dirty

我也在GitHub上发布了问题： https://github.com/docker/docker/issues/16857

I've also opened issue on GitHub: https://github.com/docker/docker/issues/16857

推荐答案

失败是因为 passwd 会处理一个临时文件，然后尝试将其重命名为 / etc / shadow 。失败是因为 / etc / shadow 是一个安装点-无法替换-导致此错误（使用 strace ）：

It's failing because passwd manipulates a temporary file, and then attempts to rename it to /etc/shadow. This fails because /etc/shadow is a mountpoint -- which cannot be replaced -- which results in this error (captured using strace):

102   rename("/etc/nshadow", "/etc/shadow") = -1 EBUSY (Device or resource busy)

您可以从命令行轻松重现此内容：

You can reproduce this trivially from the command line:

# cd /etc
# touch foo
# mv foo shadow
mv: cannot move 'foo' to 'shadow': Device or resource busy

您可以通过装入包含<$ c的目录来解决此问题$ c> my_shadow 和 my_passwd 在其他地方，然后符号链接 / etc / passwd 和 / etc / shadow 适当地放在容器中：

You could work around this by mounting a directory containing my_shadow and my_passwd somewhere else, and then symlinking /etc/passwd and /etc/shadow in the container appropriately:

$ docker run -it --rm -v $PWD/my_etc:/my_etc centos
[root@afbc739f588c /]# ln -sf /my_etc/my_passwd /etc/passwd
[root@afbc739f588c /]# ln -sf /my_etc/my_shadow /etc/shadow
[root@afbc739f588c /]# ls -l /etc/{shadow,passwd}
lrwxrwxrwx. 1 root root 17 Oct  8 17:48 /etc/passwd -> /my_etc/my_passwd
lrwxrwxrwx. 1 root root 17 Oct  8 17:48 /etc/shadow -> /my_etc/my_shadow
[root@afbc739f588c /]# passwd root
Changing password for user root.
New password: 
Retype new password: 
passwd: all authentication tokens updated successfully.
[root@afbc739f588c /]# 

这篇关于无法在装有/ etc / passwd和/ etc / shadow的docker容器中添加新用户的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！