☰

docker下的qemu2.6

tag-icon • tag-icon docker
docker下的qemu2.6

我基于 ubuntu 16 构建了包含 qemu2.5 的 docker 容器。当我尝试运行 libvirt 时，出现此错误：

root@1116a7e45f20:/# /etc/init.d/libvirt-bin start
 * Starting libvirt management daemon libvirtd
/usr/sbin/libvirtd: error while loading shared libraries: libvirt-admin.so.0: cannot open shared object file: Permission denied
Waiting for /var/run/libvirt/libvirt-sock - recheck in 2 sec
Waiting for /var/run/libvirt/libvirt-sock - recheck in 2 sec
Waiting for /var/run/libvirt/libvirt-sock - recheck in 2 sec
Waiting for /var/run/libvirt/libvirt-sock - recheck in 2 sec
Waiting for /var/run/libvirt/libvirt-sock - recheck in 2 sec
Giving up waiting for /var/run/libvirt/libvirt-sock.

我使用标志 --privileged 运行 docker 容器 在 docker 容器内，我无法在 apparmor 中为 libvirt 添加新规则，例如：

root@1116a7e45f20:/# aa-complain /etc/apparmor.d/usr.sbin.libvirtd
Setting /etc/apparmor.d/usr.sbin.libvirtd to complain mode.

ERROR: Cache read/write disabled: interface file missing. (Kernel needs AppArmor 2.4 compatibility patch.)
Warning: unable to find a suitable fs in /proc/mounts, is it mounted?
Use --subdomainfs to override.

有 strace 输出：

lose(4)                                = 0
read(3, "1\n", 128)                     = 2
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=514, si_uid=0, si_status=0, si_utime=0, si_stime=0} ---
rt_sigreturn({mask=[]})                 = 2
read(3, "", 128)                        = 0
close(3)                                = 0
wait4(-1, [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 514
stat("/var/run/libvirt/libvirt-sock", 0x7ffed1f87c90) = -1 ENOENT (No such file or directory)
write(1, "Waiting for /var/run/libvirt/lib"..., 61Waiting for /var/run/libvirt/libvirt-sock - recheck in 2 sec
) = 61
clone(child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7fe834b3e9d0) = 515
wait4(-1, [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 515
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=515, si_uid=0, si_status=0, si_utime=0, si_stime=0} ---
rt_sigreturn({mask=[]})                 = 515
pipe([3, 4])                            = 0
clone(child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7fe834b3e9d0) = 516
close(4)                                = 0
read(3, "0\n", 128)                     = 2
read(3, "", 128)                        = 0
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=516, si_uid=0, si_status=1, si_utime=0, si_stime=0} ---
rt_sigreturn({mask=[]})                 = 0
close(3)                                = 0
wait4(-1, [{WIFEXITED(s) && WEXITSTATUS(s) == 1}], 0, NULL) = 516
write(1, "Giving up waiting for /var/run/l"..., 53Giving up waiting for /var/run/libvirt/libvirt-sock.
) = 53
exit_group(1)                           = ?
+++ exited with 1 +++

只有一个库没有显示其路径

root@1116a7e45f20:/# ldd /usr/sbin/libvirtd
        linux-vdso.so.1 =>  (0x00007ffd58fa2000)

这个容器有什么问题吗？请问，这个错误的根本原因是什么？

答案1

此错误的根本原因是来自 HOST 的 apparmor。因此，您应该在主机系统上禁用或允许 docker。这个错误就会消失。

此外，所有内核参数都从主机系统传递到客户系统。因此，您应该提前允许 /dev/kvm 使用第三个用户（ 666 ）。

相关内容