无法通过http + docker://localhost连接到Docker守护程序-它正在运行吗?(特殊用例) [英] Couldn't connect to Docker daemon at http+docker://localhost - is it running? (special use case)

问题描述

我想你们都知道这个错误.为了弄清楚为什么我会迷惑它，您可能需要一些有关上下文的背景信息，因为它并不是真正的常用(至少我认为是这样).

I guess you all know this error pretty good. In order to understand why I may encouter it, you may need some background info about the context as it's not really a common use (i think at least).

1. 我有一个UNRAID服务器
2. 在此服务器上运行的VM
3. 通过此VM中的compose在容器中运行的一堆服务(以后称为我的生产VM)
4. [问题]我需要添加一个容器，该容器本身将通过此官方图片运行

最后一个容器由我自己维护，应运行API，Web客户端，db等.构建它时，我首先触发我开发的代理，api，web和其他项目的构建，一旦完成，我将根据刚刚构建的图像和一些开源图像来构建一个.

This last container is maintained by myself and should run an API, web client, db, ect. When building it I first trigger the build of proxy, api, web and other project that I develop and once ot's done I build the compose one from the images I just built and some open source ones.

为了进行测试，我在不受限制的服务器上创建了一个虚拟VM，并创建了一个类似于生产VM的撰写环境.(我们称之为测试虚拟机).我只用我的应用程序和portainer添加了compose文件.

To test I created a dummy VM on my unraid server and created a compose environment similar to my production VM. (let's call it my test VM). I added a compose file with only my app and portainer.

问题是，当我在该测试服务器上运行"docker-compose up"时，portainer启动，但我的应用失败，因为它无法连接到它的docker守护程序(请参见下面的日志)

The problem is when I run 'docker-compose up' on that test server, portainer start but my app fails because it cannot connect to it's docker daemon (see logs below)

我尝试过的事情:

• 以root用户或创建的用户身份运行我的应用程序
• 将创建的用户添加到docker组(但是docker group不存在，所以我正在创建它；对我来说似乎很奇怪...)
• 检查/var/run/docker.sock 上的权限:它甚至返回root都未找到文件错误
• 通过卷(-"/var/run/docker.sock:/var/run/docker.sock" )运行父级组合时，从我的测试VM中传递套接字
li>

• running my app as root or a created user
• adding the created user to docker group (but docker group does not exists so I'm creating it; seems odd to me...)
• checking permission on /var/run/docker.sock: it returned a file not found error even as root
• passing the socket from my test VM when running the parent compose via a volume (- "/var/run/docker.sock:/var/run/docker.sock")

Dockerfile:

Dockerfile:

FROM docker/compose

# Create plaxdmin user
RUN adduser plaxdmin --disabled-password
RUN addgroup docker
RUN addgroup plaxdmin docker
USER plaxdmin


# Final values
ARG PLAXDMIN_VERSION
ARG RELEASE_TYPE
ENV PLAXDMIN_VERSION=$PLAXDMIN_VERSION
ENV RELEASE_TYPE=$RELEASE_TYPE

# Default user defined values
ENV TIMEZONE=Europe/Paris
ENV PLAXDMIN_DNS="plaxdmin.default.org"


# Init folders and copy docker-compose api configuration files
WORKDIR /var/log/plaxdmin

WORKDIR /etc/plaxdmin
ADD ./resources/conf/* ./

WORKDIR /opt/plaxdmin/
ADD ./resources/docker-compose.yml ./


# Expose port
EXPOSE 80


# On run debug and start compose fleet
CMD    docker -v \
    && docker-compose -v \
    && printenv \
    && ls -al /etc/plaxdmin \
    && ls -al /opt/plaxdmin/ \
    && ls -al /var/log/plaxdmin/ \
    && pwd \
    && whoami \
    && groups $user \
#    && ls -la /var/run/docker.sock \
    && docker-compose up || true

docker构建日志:

docker build logs:

Step 1/18 : FROM docker/compose
latest: Pulling from docker/compose
aad63a933944: Pulling fs layer
b396cd7cbac4: Pulling fs layer
0426ec0ed60a: Pulling fs layer
9ac2a98ece5b: Pulling fs layer
9ac2a98ece5b: Waiting
b396cd7cbac4: Verifying Checksum
b396cd7cbac4: Download complete
aad63a933944: Verifying Checksum
aad63a933944: Download complete
aad63a933944: Pull complete
0426ec0ed60a: Verifying Checksum
0426ec0ed60a: Download complete
b396cd7cbac4: Pull complete
9ac2a98ece5b: Verifying Checksum
9ac2a98ece5b: Download complete
0426ec0ed60a: Pull complete
9ac2a98ece5b: Pull complete
Digest: sha256:b60a020c0f68047b353a4a747f27f5e5ddb17116b7b018762edfb6f7a6439a82
Status: Downloaded newer image for docker/compose:latest
 ---> c3e188a6b38f
Step 2/18 : RUN adduser plaxdmin --disabled-password
 ---> Running in 07aa9a297234
Removing intermediate container 07aa9a297234
 ---> 494c8a4291e0
Step 3/18 : RUN addgroup docker
 ---> Running in f64e5022e65d
Removing intermediate container f64e5022e65d
 ---> 84ee5fbf6dea
Step 4/18 : RUN addgroup plaxdmin docker
 ---> Running in 0efa66b73f4a
Removing intermediate container 0efa66b73f4a
 ---> eb647c03c118
Step 5/18 : USER plaxdmin
 ---> Running in 4529203341d1
Removing intermediate container 4529203341d1
 ---> 8501d9993307
Step 6/18 : ARG PLAXDMIN_VERSION
 ---> Running in 07d61186fadd
Removing intermediate container 07d61186fadd
 ---> ed6e9f9df0ab
Step 7/18 : ARG RELEASE_TYPE
 ---> Running in 0fa98c641843
Removing intermediate container 0fa98c641843
 ---> d0fe2f700e53
Step 8/18 : ENV TIMEZONE=Europe/Paris
 ---> Running in 5c5d383c6858
Removing intermediate container 5c5d383c6858
 ---> 48394a4e01b3
Step 9/18 : ENV PLAXDMIN_DNS="plaxdmin.default.org"
 ---> Running in 187304a8a1ed
Removing intermediate container 187304a8a1ed
 ---> 5827abebd0ff
Step 10/18 : ENV PLAXDMIN_VERSION=$PLAXDMIN_VERSION
 ---> Running in 54ff13db32e6
Removing intermediate container 54ff13db32e6
 ---> 9377ac82544e
Step 11/18 : ENV RELEASE_TYPE=$RELEASE_TYPE
 ---> Running in 2da68d0375ac
Removing intermediate container 2da68d0375ac
 ---> dd09ee57c867
Step 12/18 : WORKDIR /var/log/plaxdmin
 ---> Running in 9ac2fdb93c5e
Removing intermediate container 9ac2fdb93c5e
 ---> 252771ee5ff4
Step 13/18 : WORKDIR /etc/plaxdmin
 ---> Running in eb6c9a16b12f
Removing intermediate container eb6c9a16b12f
 ---> 6fd180adcb80
Step 14/18 : ADD ./resources/conf/* ./
 ---> 70e10c126b4f
Step 15/18 : WORKDIR /opt/plaxdmin/
 ---> Running in 0a6f15afc915
Removing intermediate container 0a6f15afc915
 ---> d8c321d31689
Step 16/18 : ADD ./resources/docker-compose.yml ./
 ---> 60847c38d0be
Step 17/18 : EXPOSE 80
 ---> Running in cbe2a4d7f8be
Removing intermediate container cbe2a4d7f8be
 ---> 56269d51e6d5
Step 18/18 : CMD    docker -v     && docker-compose -v     && printenv     && ls -al /etc/plaxdmin     && ls -al /opt/plaxdmin/     && ls -al /var/log/plaxdmin/     && pwd     && whoami     && groups $user     && docker-compose up || true
 ---> Running in 49d1a3505198
Removing intermediate container 49d1a3505198
 ---> beba0e2fd039
Successfully built beba0e2fd039
Successfully tagged plaxdmin/full:latest
Successfully tagged plaxdmin/full:unstable
Successfully tagged plaxdmin/full:v-202102010319
Successfully tagged plaxdmin/full:64ce4f02f88ac81219dd61ae0d8c2e4aa6e0403e
Successfully tagged plaxdmin/full:master

启动日志:

plaxdmin_1   | Docker version 19.03.8, build afacb8b7f0
plaxdmin_1   | docker-compose version 1.26.2, build eefe0d3
plaxdmin_1   | HOSTNAME=b3a358707bd6
plaxdmin_1   | SHLVL=2
plaxdmin_1   | HOME=/home/plaxdmin
plaxdmin_1   | PGID=1421
plaxdmin_1   | TIMEZONE=Europe/Paris
plaxdmin_1   | RELEASE_TYPE=unstable
plaxdmin_1   | PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
plaxdmin_1   | PLAXDMIN_DNS=plaxdmin.vba.ovh
plaxdmin_1   | PUID=1421
plaxdmin_1   | PWD=/opt/plaxdmin
plaxdmin_1   | PLAXDMIN_VERSION=v-202102010319
plaxdmin_1   | total 20
plaxdmin_1   | drwxr-xr-x    1 root     root          4096 Feb  1 15:57 .
plaxdmin_1   | drwxr-xr-x    1 root     root          4096 Feb  1 15:59 ..
plaxdmin_1   | -rw-rw-rw-    1 root     root           262 Jan 31 02:06 application.properties
plaxdmin_1   | -rw-rw-rw-    1 root     root           690 Jan 31 02:06 log4j.properties
plaxdmin_1   | -rw-rw-rw-    1 root     root          1518 Jan 31 19:31 nginx.conf
plaxdmin_1   | total 12
plaxdmin_1   | drwxr-xr-x    1 root     root          4096 Feb  1 15:57 .
plaxdmin_1   | drwxr-xr-x    1 root     root          4096 Feb  1 15:57 ..
plaxdmin_1   | -rw-rw-rw-    1 root     root          2374 Feb  1 02:01 docker-compose.yml
plaxdmin_1   | total 8
plaxdmin_1   | drwxr-xr-x    2 root     root          4096 Feb  1 15:57 .
plaxdmin_1   | drwxr-xr-x    1 root     root          4096 Feb  1 15:57 ..
plaxdmin_1   | /opt/plaxdmin
plaxdmin_1   | plaxdmin
plaxdmin_1   | plaxdmin docker
plaxdmin_1   | Couldn't connect to Docker daemon at http+docker://localhost - is it running?
plaxdmin_1   | 
plaxdmin_1   | If it's at a non-standard location, specify the URL with the DOCKER_HOST environment variable.

推荐答案

由于容器的目标是运行Docker命令，因此它有权接管整个主机系统(如果选择的话).以 USER root 身份运行它同样安全，这也将解决套接字权限问题.由于您的Dockerfile实际上不会执行任何切换到备用用户的操作( COPY 默认情况下使文件归root用户所有，并且您不 RUN 个命令)，因此您也可以删除 USER 行和备用用户设置.

Since the goal of your container is to run Docker commands, it has permissions to take over the entire host system should it choose to. It's not any less safe to run it as USER root, which will also address the socket permission problem. Since your Dockerfile doesn't actually do anything switched to the alternate user (COPY makes files be owned by root by default and you do not RUN any commands) you can also delete the USER line and the alternate-user setup.

# This user and group will not be used; delete these lines
# RUN adduser plaxdmin --disabled-password
# RUN addgroup docker
# RUN addgroup plaxdmin docker

# Nothing is done as this user
# Stay as the default root user to be able to run `docker` commands
# USER plaxdmin

如果主机的/var/run/docker.sock 处于模式0660并由组 docker 拥有(典型设置)，则容器进程必须以相同的方式运行数字组ID，以便能够访问套接字.这本质上将是特定于主机的，并且您不能在Dockerfile中设置.

If the host's /var/run/docker.sock is mode 0660 and owned by a group docker (a typical setup) the container process must run as the same numeric group ID in order to be able to access the socket. This will intrinsically be host-specific and it's not something you can set in your Dockerfile.

启动业务流程容器时，可以对其进行额外运行组放入 docker 组

When you launch the orchestration container, you can run it with an additional group to put it in the docker group

# If the container process isn't already running as root
docker run \
  -v /var/run/docker.sock:/var/run/docker.sock \
  --group-add docker \
  ...

或者，在Compose版本2语法(但不是版本3)中，有一个可以指定此选项的 group_add: 选项

Or, in Compose version 2 syntax (but not version 3) there is a group_add: option that can specify this

version: '2.4'
services:
  orchestrator:
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
    group_add:
      - docker

(文档说该组必须在两种情况下都存在，因此您可能需要

(The documentation says the group must exist in both contexts, so you may need to look up the numeric group ID and use that instead.)

这篇关于无法通过http + docker://localhost连接到Docker守护程序-它正在运行吗?(特殊用例)的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！