systemd-journald.service:单元配置IP防火墙,但本地系统不支持BPF/cgroup

systemd-journald.service:单元配置IP防火墙,但本地系统不支持BPF/cgroup

我刚刚在我的 jetson nano 上安装了 ubuntu 22.04。 Docker 无法在 22.04 上运行,但可以在 ubuntu 18.04 和 20.04 上运行。我在 ubuntu 18,20 和 22 上使用了相同的内核版本。这:

Linux marietto-nano 4.9.299+ #0 SMP PREEMPT Wed Mar 29 14:22:17 CEST 2023 aarch64 aarch64 aarch64 GNU/Linux

所以如果它不起作用,那不是它的错。我认为仅在 ubuntu 22.04 上存在的某些组件之间存在一些不兼容性,而在 ubuntu 18 和 20 上则不存在。错误如下:

# docker images

REPOSITORY    TAG       IMAGE ID       CREATED         SIZE
hello-world   latest    46331d942d63   13 months ago   9.14kB

# docker run hello-world

docker: Error response from daemon: failed to create shim task: OCI runtime create failed: runc create failed: unable to start container process: error during container init: error setting cgroup config for procHooks process: bpf_prog_query(BPF_CGROUP_DEVICE) failed: function not implemented: unknown.
ERRO[0004] error waiting for container: context canceled

我不知道该怎么办。我什至尝试按照本指南升级 docker 容器文件:

https://www.server-world.info/en/note?os=Ubuntu_22.04&p=nvidia&f=2

所以,这就是我所做的:

# curl -s -L https://nvidia.github.io/nvidia-docker/gpgkey | apt-key add -
OK

# curl -s -L https://nvidia.github.io/nvidia-docker/ubuntu22.04/nvidia-docker.list > /etc/apt/sources.list.d/nvidia-docker.list

# apt upgrade

升级之前我有这些版本:

nvidia-docker2/stable,now 2.8.0-1 all
nvidia-container-toolkit/stable,now 1.7.0-1 arm64

后 :

nvidia-docker2/bionic 2.13.0-1 all
nvidia-container-toolkit/bionic 1.13.1-1 arm64
nvidia-container-toolkit-base/bionic 1.13.1-1 arm64

它们已经升级了,但我仍然看到这些软件包来自 bionic,但我使用了 jammy 的存储库

# curl -s -L https://nvidia.github.io/nvidia-docker/ubuntu22.04/nvidia-docker.list > /etc/apt/sources.list.d/nvidia-docker.list

这是文件 /etc/docker/daemon.json 的内容:

{
    "runtimes": {
        "nvidia": {
            "path": "nvidia-container-runtime",
            "runtimeArgs": []
        }
    }
}

我正在使用 JetPack 4.6.3 / L4T 32.7.3。 runc 版本是:

# runc --version

runc version 1.1.4-0ubuntu1~22.04.1
spec: 1.0.2-dev
go: go1.18.1
libseccomp: 2.5.3

码头工人版本是:

# docker --version
Docker version 20.10.21, build 20.10.21-0ubuntu1~22.04.3

无论如何,即使升级了软件包,错误也没有得到修复。

作为进一步的实验,我清除了为 ubuntu 22.04 安装的所有软件包,并安装了适用于 ubuntu 20.04 的相同软件包的版本。他们的名字是这样的:

cgroup-tools_0.41-10_arm64.deb
docker.io_20.10.21-0ubuntu1~20.04.1_arm64.deb
containerd_1.6.12-0ubuntu1~20.04.1_arm64.deb
runc_1.1.4-0ubuntu1~20.04.1_arm64.deb

但是,我遇到了与以前相同的错误:

root@marietto-nano:/home/marietto# docker run hello-world

docker: Error response from daemon: failed to create shim task: OCI runtime create failed: runc create failed: unable to start container process: error during container init: error setting cgroup config for procHooks process: bpf_prog_query(BPF_CGROUP_DEVICE) failed: function not implemented: unknown.
ERRO[0000] error waiting for container: context canceled 

这是“check-config.sh”脚本的输出:

root@marietto-nano:/home/marietto/Scaricati# ./check-config.sh

info: reading kernel config from /proc/config.gz ...

Generally Necessary:
- cgroup hierarchy: cgroupv2
  Controllers:
  **- cpu: missing
  - cpuset: missing**
  - io: available
  - memory: available
  - pids: available
- CONFIG_NAMESPACES: enabled
- CONFIG_NET_NS: enabled
- CONFIG_PID_NS: enabled
- CONFIG_IPC_NS: enabled
- CONFIG_UTS_NS: enabled
- CONFIG_CGROUPS: enabled
- CONFIG_CGROUP_CPUACCT: enabled
- CONFIG_CGROUP_DEVICE: enabled
- CONFIG_CGROUP_FREEZER: enabled
- CONFIG_CGROUP_SCHED: enabled
- CONFIG_CPUSETS: enabled
- CONFIG_MEMCG: enabled

在日志上我看到这些错误:

cgroup: cgroup2: unknown option "nsdelegate,memory_recursiveprot"
cgroup: cgroup2: unknown option "nsdelegate"
cgroup: cgroup: disabling cgroup2 socket matching due to net_prio or net_cls activatn

修复 Docker 还缺少什么?谢谢。

相关内容