docker 运维记录（docker运维工具）

docker 错误记录

一：防火墙异常

[root@c130 opt]# docker run -d -p 5000:5000 -v /opt/data/registry:/tmp/registry registry

f82b2fc298b4371a169fb171b2583302746d7eceeb3f4b1b04f66c4da8302c7b

docker: Error response from daemon: driver failed programming external connectivity on endpoint zealous_lovelace (66a282bb9fc9ca9cffa6b8d09e3faaefbfcbdd04524d6fdcd43b3a451c3336f2): (iptables failed: iptables --wait -t nat -A DOCKER -p tcp -d 0/0 --dport 5000 -j DNAT --to-destination 172.17.0.2:5000 ! -i docker0: iptables: No chain/target/match by that name.

(exit status 1)).

iptables -nvL

检查防火墙是否启动

开启即可

systemctl start firewalld

二：解决 Docker pull 出现的 Server error: Status 0 while fetching image layer 的一个办法

出现这个问题，一般的原因是无法连接到 docker hub，通过：

$ sudo systemctl stop docker

$ sudo docker -d -D

开启 debug 模式，然后再运行 pull 就会出现类似下面的错误：

DEBU[0282] Error contacting registry https://registry-1.docker.io/v1/: Get https://dseasb33srnrn.cloudfront.net/registry-v2/docker/registry/v2/blobs/sha256/a3/a3ed95caeb02ffe68cdd9fd84406680ae93d633cb16422d00e8a7c22955b46d4/data?Expires=1449474474&Signature=Gw6Y0xqjZT-1S8kPpNg9Z6GA~SH6SunDvh3eNGWvDQtBrotU9Qv6a3Mr6sAkP5L84zM32lsTxGrIehFKyEuwVncRy1sfEI-4Ggiuvqedwaw61HFYYBefoQJHDUtHOxUZkOJ6AuUlxOJeKhfHyLDMmPf3H1NSQ8U8L5Mf8rUXL0M_&Key-Pair-Id=APKAJECH5M7VWIS5YZ6Q: net/http: TLS handshake timeout

很明显可以看出是连接不到 docker hub，那就需要查看网络原因了。可能需要个梯子。当然较简单的解决办法就是用国内的仓库，下面的方法就是使用国内的 daocloud 的仓库：

$ echo "DOCKER_OPTS=\"\$DOCKER_OPTS --registry-mirror=http://f2d6cb40.m.daocloud.io\"" | sudo tee -a /etc/default/docker $ sudo service docker restart

三：WARNING: IPv4 forwarding is disabled. Networking will not work.

echo 1 > /proc/sys/net/ipv4/ip_forward

路由器功能，ip转发

四：docker 启动失败

failed to start daemon: Error initializing network controller: Error creating default "bridge" network: Poo

cd /var/lib/docker/network/files

rm -rf *

systemctl restart docker.service

五：Starting docker (via systemctl): Job for docker.service failed. See 'systemctl status docker.service' and 'journalctl -xn' for details.

输入：systemctl status docker.service

docker.service - LSB: start and stop docker

Loaded: loaded (/etc/rc.d/init.d/docker)

Active: failed (Result: exit-code) since Fri 2014-12-05 14:45:53 CST; 2min 59s ago

Process: 1364 ExecStop=/etc/rc.d/init.d/docker stop (code=exited, status=0/SUCCESS)

Process: 1551 ExecStart=/etc/rc.d/init.d/docker start (code=exited, status=7)

Dec 05 14:45:53 docker systemd[1]: Starting LSB: start and stop docker...

Dec 05 14:45:53 docker docker[1551]: [FAILED]

Dec 05 14:45:53 docker docker[1551]: /var/run/docker.pid still exists...

Dec 05 14:45:53 docker systemd[1]: docker.service: control process exited, code=exited status=7

Dec 05 14:45:53 docker systemd[1]: Failed to start LSB: start and stop docker.

Dec 05 14:45:53 docker systemd[1]: Unit docker.service entered failed state.

处理方法：

删除/var/run/docker.pid

六：/etc/hosts文件无法修改，这样你就不能自己做域名解析

第1个问题的解决方案是通过安装dnsmasq软件来做域名解析：

# 首先，在你的Container里面安装dnsmasq软件: apt-get install dnsmasq # 将以下文本添加到 /etc/dnsmasq.conf文件的最后： listen-address=127.0.0.1 resolv-file=/etc/resolv.dnsmasq.conf conf-dir=/etc/dnsmasq.d user=root # 接着在/etc/dnsmasq.d/目录下新建一个文件，随意起个名字 vi /etc/dnsmqsq.d/dns.conf # 指定你要映射的域名，例如google.com，则将下面贴进dns.conf文件 address="/google.com/172.17.0.4" # 最后退出容器，重启启动容器时，通过-dns选项指定域名服务器 docker run -i -t -dns 127.0.0.1 -dns 8.8.8.8 dev:base /bin/bash # 一定要注意上面添加google的域名服务器8.8.8.8，否则你访问不了外网 # 进去Container后，启动dnsmasq，这样你就能够ping google.com了 /etc/init.d/dnsmasq start

七：Object “netns” is unknown, try “ip help”.

https://repos.fedorapeople.org/repos/openstack/openstack-juno/rdo-release-juno-1.noarch.rpm

yum install -y http://rdo.fedorapeople.org/rdo-release.rpm

yum -y install iproute

reboot

八：编译错误 openvswitch.ko

按照安装文档一步步安装，make && make install 命令成功后，执行insmod datapath/linux/openvswitch.ko ，将路径插入kernel内核时，遇到问题

insmod: ERROR: could not insert moudle datapath/linux/openvswitch.ko: Unknown symbol in moudle

解决办法：首先执行命令modinfo datapath/linux/openvswitch.ko ,出现如下信息：

[root@d3 openvswitch-2.5.0]# modinfo datapath/linux/openvswitch.ko

filename: /root/openvswitch-2.5.0/datapath/linux/openvswitch.ko

version: 2.5.0

license: GPL

description: Open vSwitch switching datapath

rhelversion: 7.2

srcversion: BCB187306A953A0E464CFD2

depends: nf_conntrack,nf_defrag_ipv6,libcrc32c,gre,nf_defrag_ipv4

vermagic: 3.10.0-327.18.2.el7.x86_64 SMP mod_unload modversions

parm: udp_port:Destination UDP port (ushort)

可以看到，openvswitch.ko依赖于nf_conntrack, nf_defrag_ipv6, libcrc32c, gre四个文件，问题就在于这四个文件没有被载入！

执行命令modprobe nf_conntrack && modprobe nf_defrag_ipv6 && modprobe libcrc32c && modprobe gre ,

然后再执行insmod datapath/linux/openvswitch.ko 即可

九：ssh 启动报key错误

docker run -it -p 88:22 centos7:v2.0 /data/scripts/auto.sh

Could not load host key: /etc/ssh/ssh_host_rsa_key

Could not load host key: /etc/ssh/ssh_host_ecdsa_key

Could not load host key: /etc/ssh/ssh_host_ed25519_key

sshd: no hostkeys available -- exiting.

密钥文件是否存在，是否正确，可重新生成

生成rsa_key

ssh-keygen -t rsa -f /etc/ssh/ssh_host_rsa_key

生成ecdsa_key

ssh-keygen -t ecdsa -f /etc/ssh/ssh_host_ecdsa_key

生成ed25519_key

ssh-keygen -t ed25519 -f /etc/ssh/ssh_host_ed25519_key

十：docker: Error response from daemon: OCI runtime create failed: container_linux.go:348: starting container process caused "exec: \"ip\": executable file not found in $PATH": unknown.

ip 不存在，因为默认容器里不存在这个命令

十一：私有仓库推送报错

登录错误

Error response from daemon: Get https://harbor.meng.com/v2/: dial tcp 192.168.10.33:443: getsockopt: connection refused

The push refers to repository [192.168.10.31:5000/centos7]

Get https://192.168.10.31:5000/v2/: net/http: request canceled while waiting for connection (Client.Timeout exceeded while awaiting headers)

http: server gave HTTP response to HTTPS client

此处搭建的私有仓库只提供http服务，所以当与私有仓库交互时就会报上面的错误

centos 7

在需要push镜像的节点上进行：

/etc/docker/daemon.json

{ "insecure-registries":["192.168.10.31:5000","harbor.shiye.com","harbor.meng.com"] }

重启服务

systemctl daemon-reload

systemctl restart docker

十二：没有可用软件包 pip。

yum -y install epel-release

yum -y install python-pip

十三：docker 容器启动消失，jenkins docker volume权限问题

docker run -p 8080:8080 -p 50000:50000 -d -v /opt/jenkins-home-docker:/var/jenkins_home --name jenkins jenkins/jenkins

查看日志 docker logs jenkins

touch: cannot touch '/var/jenkins_home/copy_reference_file.log': Permission denied

Can not write to /var/jenkins_home/copy_reference_file.log. Wrong volume permissions?

查看jenkins运行账号

docker run -ti --rm --entrypoint="/bin/bash" jenkins -c "whoami && id" jenkins uid=1000(jenkins) gid=1000(jenkins) groups=1000(jenkins)

查看jenkins目前权限

docker run -ti --rm --entrypoint="/bin/bash" jenkins -c "ls -la /var/jenkins_home"

映射本地数据卷时，权限变成root

docker run -ti --rm -v /opt/jenkins-home-docker:/var/jenkins_home --entrypoint="/bin/bash" jenkins -c "ls -la /var/jenkins_home"

这就解释了为什么当"jenkins"用户的进程访问"/var/jenkins_home"目录时，会出现 Permission denied 的问题

发现问题之后，相应的解决方法也很简单：把当前目录的拥有者赋值给uid 1000，再启动"jenkins"容器就一切正常了

sudo chown -R 1000 /opt/jenkins-home-docker docker start jenkins

如果有异常，检查关闭selinux

sestatus

临时关闭

setenforce 0

十四：jenkins 里执行docker ps 命令提示错误

docker: error while loading shared libraries: libltdl.so.7: cannot open shared object file: No such file or directory

可通过启动jenkins做内部映射即可

-v /usr/lib64/libltdl.so.7:/usr/lib/x86_64-linux-gnu/libltdl.so.7

十五：could not load host key: /etc/ssh/ssh_host_rsa_key 无法启动ssh的一个解决办法

重新生成SSH主机密钥

在CentOS、RHEL或Fedora上，你所要做的是，删除现存（有问题的）密钥，然后重启sshd服务。

# rm -r /etc/ssh/ssh*key

# systemctl restart sshd

另外一个重新生成SSH主机密钥的方式是，使用ssh-keygen命令来手动生成。

# ssh-keygen -t rsa -f /etc/ssh/ssh_host_rsa_key

# ssh-keygen -t dsa -f /etc/ssh/ssh_host_dsa_key

# ssh-keygen -t ecdsa -f /etc/ssh/ssh_host_ecdsa_key

在生成新的SSH主机密钥后，确保它们能在/etc/ssh目录中找到。此时，不必重启sshd服务

最合适的解决方式：

直接输入

ssh-keygen -t dsa -f /etc/ssh/ssh_host_dsa_key

重启ssh，然后就好了

十六：解决" Could not load host key: /etc/ssh/ssh_host_ed25519_key"问题

这是因为新版的opensshd 中添加了ed25519 做签名验证，而之前系统里没这个算法的证书。生成一下就好了

解决方法很简单

ssh-keygen -A

- 或者

ssh-keygen -t ed25519 -f /etc/ssh/ssh_host_ed25519_key

- 然后

service sshd restart