☰

`sssd.conf` 上的 docker 权限

tag-icon • tag-icon linux debian docker sssd docker-compose
`sssd.conf` 上的 docker 权限

我知道它非常具体sssd.conf。但是在COPY（或ADD）时sssd.conf我收到了相同的错误：

ERROR: Service 'samba_adc' failed to build: failed to copy files: failed to copy file: Error processing tar file(exit status 1): Error setting up pivot dir: mkdir /share/CACHEDEV1_DATA/virtual_machines/container-station-data/lib/docker/overlay/332546c2c487355deb45468b291abacce80701b04c6061575887eceb3858a6cd/merged/etc/sssd/conf.d/.pivot_root030453588: operation not permitted

稍后在运行时将任何内容放入目录都会失败：

# echo "sssd was here" > /etc/sssd/foo
bash: /etc/sssd/foo: Operation not permitted

chmod 对目录中的任何内容都失败

# chmod 755 /etc/sssd
chmod: changing permissions of '/etc/sssd': Operation not permitted

USER root在命令前添加一个不会产生任何效果。这是 docker 17.07，所以--chown=root不可能。

运行lsattr/chattr也是没用的：

# chattr -i /etc/sssd
chattr: Inappropriate ioctl for device while reading flags on /etc/sssd

为了解决这个问题，还有其他一些尝试：

# rmdir /etc/sssd
rmdir: failed to remove '/etc/sssd': Directory not empty

# su sssd
# echo "sssd was here" > /etc/sssd/foo
bash: /etc/sssd/foo: Operation not permitted

到现在我感到很困惑，谷歌没有给我提供更多的东西，我希望我遗漏了一些东西。如果你需要我的完整资料，它们是这里 (github)。

编辑，添加信息：

docker -D info

Containers: 0
 Running: 0
 Paused: 0
 Stopped: 0
Images: 59
Server Version: 17.07.0-ce
Storage Driver: overlay
 Backing Filesystem: extfs
 Supports d_type: true
Logging Driver: json-file
Cgroup Driver: cgroupfs
Plugins:
 Volume: local
 Network: bridge host macvlan null overlay
 Log: awslogs fluentd gcplogs gelf journald json-file logentries splunk syslog
Swarm: inactive
Runtimes: runc
Default Runtime: runc
Init Binary: docker-init
containerd version:  (expected: 3addd840653146c90a254301d6c3a663c7fd6429)
runc version: N/A (expected: 2d41c047c83e09a6d61d464906feb2a2f3c52aa4)
init version: 949e6fa
Kernel Version: 4.2.8
Operating System: QTS 4.3.4 (20180315)
OSType: linux
Architecture: x86_64
CPUs: 4
Total Memory: 7.682GiB
Name: NAS
ID: CTVG:6D5G:WCK4:PXAX:GCYG:HPKN:25A2:N4AC:TRXT:ADAS:XTPB:DI2E
Docker Root Dir: /share/CACHEDEV1_DATA/virtual_machines/container-station-data/lib/docker
Debug Mode (client): true
Debug Mode (server): true
 File Descriptors: 70
 Goroutines: 80
 System Time: 2018-03-28T11:11:47.511378666-07:00
 EventsListeners: 1
Registry: https://index.docker.io/v1/
Experimental: false
Insecure Registries:
 127.0.0.0/8
Live Restore Enabled: false

WARNING: No kernel memory limit support

docker version

Client:
 Version:       18.03.0-ce
 API version:   1.31 (downgraded from 1.37)
 Go version:    go1.9.4
 Git commit:    0520e24
 Built: Wed Mar 21 23:10:06 2018
 OS/Arch:       linux/amd64
 Experimental:  false
 Orchestrator:  swarm

Server:
 Engine:
  Version:      17.07.0-ce
  API version:  1.31 (minimum version 1.12)
  Go version:   go1.8.3
  Git commit:   fd7dc00
  Built:        Thu Feb  8 15:57:38 2018
  OS/Arch:      linux/amd64
  Experimental: false

主人的uname -r

uname -r
4.2.8

答案1

您用来执行操作的用户对父目录没有写权限。

答案2

答案是，问题出在层上。在某些情况下，一旦创建了层，该层文件的权限就无法修改。（笔记：我不确定哪些情况会导致能够或不能。）因此，尽管我在任何先前层中所做的任何事情都可能让我无法更改在过去的层中创建的特定文件的权限、所有权等。如果我在层内或之前执行此操作，那么使用类似的东西touch <blahfile> && chmod 600 <blahfile>是完全可行的。就像（也是我的最终解决方案）一样：

apt install sssd <and other requirements> && chmod 755 /etc/sssd

相关内容