Ahoj, trochu si hraju s Dockerem. Chtěl bych mít jeden kontejner s php a druhý s nginx. PHP instaluju nad

FROM ubuntu:14.04.5

ENV DEBIAN_FRONTEND noninteractive

RUN apt-get -qq update
RUN apt-get install php5-fpm -y php5-cli php5-intl php5-mcrypt php5-apcu php5-gd php5-curl

RUN echo "/etc/init.d/php5-fpm start" >> /etc/bash.bashrc

EXPOSE 9000


=======================================================
nginx z

FROM nginx:1.10

ADD vhosts/nette.dev.conf /etc/nginx/conf.d/nette.dev.conf

ENV TZ=Europe/Prague
RUN echo $TZ > /etc/timezone

=======================================================

ale nginx se nemůže dobouchat na kontejner s php:

nette-nginx | 2016/09/09 20:22:32 [error] 6#6: *1 connect() failed (111: Connection refused) while connecting to upstream, client: 172.18.0.1, server: nette.dev, request: "GET / HTTP/1.1", upstream: "fastcgi://172.18.0.2:9000", host: "nette.dev"

Je fakt ze 2 roky je v oblasti kontejneru neuveritelne dlouha doba. Verim, ze spoustu chyb uz se od te doby povedlo vyladit.

GHORMOON: Pokud crashly procesy uvnitr, obcas se nam stalo, ze to neslo shodit. Po hardkillu zustavaly namountovane overlaye a nesly odmountovat, device or resource busy. Uvnitr jsme provozovali v podstate Xvfb, FF + selenium. Porad to vyzadovalo rucni zasahy. Detaily si bohuzel uz nepamatuju.

Donutilo nas to prejit k obycejnemu chrootu i za cenu bezpecnostnich kompromisu, ted se zkousime vratit k puvodni urovni izolace prave pomoci dockeru.

HVJ3R: co na tom padalo? mi se nic podobneho nedeje, mam to ocekavat?

HVJ3R: Rekneme ze s tim spis chci experimentovat, protoze Docker s jeho nedoresenym sitovanim na nektery veci neni uplne vhodnej (IPv6), a instalovat kvuli nejakym drobnostem cely novy KVM se mi nechce, resp. zbytecne by to alokovalo prostredky hosta.

NIXIMOR: Mas k tomu nejaky zasadni duvod? LXC jsme pouzivali produkcne cca dva roky zpatky a bla to bida s nouzi, padalo to, sralo se to, opustili jsme to.

Na image bootstrap, startup a monitoring jsme meli cmdline skripty, GUI nikdy neresili, protoze nam to bezelo remote v serverovnach stejne.

URPUTNIK: tak to je nejspis nejaky synchronizacni problem

NIXIMOR: pouzivam LXC hodne sporadicky a jako GUI k nemu virt-manager.

Zkusim trochu odbocit od Dockeru... pouzivate nekdo LXC jako takove? Jakoze ve forme virtualniho stroje? Zajimalo by me, jestli je k tomu nejake rozumne GUI, kde by se dala naklikat nova VM, jeji konfigurace, limity, nejak to monitorovat co vsechno vlastne na zeleze bezi a tak... Nebo se to musi resit vsechno pres cmdline?

URPUTNIK: zakon schvalnosti, chtel jsem to nasimulovat kvuli logum pro naseho teamleadera .. prvni 2 nastartovany spadly patrne z tehoz duvodu, ale ukoncoval jsem je ze startovaciho docker-compose, kde nejsou videt ty logy z vypinani s deadlocky z dtb .. a dalsich 13 uz nastartovalo dobre .. asi zalezi na poloze slunce :)

URPUTNIK: teda moje googlefu ma dneska slabsi chvilku, az ted jsem mimochodem nasel ofiko dokumentaci k tematu .. tak treba to nekomu zacinajicimu pomuze :) pro nas to minimalne znamena upgradovat docker-compose, ten nas neumi ver2 ..

URPUTNIK: ovsem po restartu uz vsechno beha jak ma, hezky se to vypina a zapina a ustoji to i zatezovy testy .. tak ja to nechapu :[ mam se na takovyhle chovani pripravit? je to s dockerem normalni?

vlastne jediny pri cem to pada (mi ted doslo) je vzdycky prvni spusteni docker-compose, pac je tam nejakej skript, co jeste updatuje strukturu databaze, je dost mozny ze se to nejak protne se startem ty db .. co jsem googlil, tak lidi reportovali stejny problemy, podle vseho zpusobeny adaptive hash indexem v mariadb pokud nekdo meni strukturu databaze .. coz ten update skript urcite dela :)

da se nejak urcit, v jakym poradi budou kontejnery startovat, umi na sebe navzajem cekat? pac ve vystupu z docker-compose jsou ty logy z jednotlivych kontejneru pomichany ..

URPUTNIK: a poustite kdyz ovladate docker demona, delate to pres /etc/init.d nebo pres service? asi bych mel pouzivat service, se zda ..

URPUTNIK: a navic je od te doby celej system podivne nakopnutej, patrne operace se souborym systemem, pac napriklad zamrzava ten filewatcher pro ideu a blokuje jeji spusteni

nakonec jsem to musel cely vypnout natrvdo a pritom jsem se jeste dostal k necemu, co jsem predtim v lozich nenasel, to je podle mne z toho padu toho mysql ..

pritom je divny, ze na zacatku minuleho tydne mi ten docker normalne behal, vcetne databaze .. a samozrejme si nejsem vedom niceho, co by se od te doby zmenilo :( nejake obvykle issues na debianu?

URPUTNIK: chm, tak to mysql dneska spadlo hned po startu .. stopnuti docker service proslo, zustal akorat ten docker-containerd-shim, killnul jsem ho .. so far good .. ale ted mi nefunguje nove 'sudo /etc/init.d/docker start', uz to startuje vic jak 20min a je to stale v tomhle stavu:

root     22375  0.0  0.0  53296  3684 pts/0    S+   10:37   0:00 sudo /etc/init.d/docker start
root     22376  0.0  0.0   4336  1552 pts/0    S+   10:37   0:00 /bin/sh /etc/init.d/docker start
root     22383  0.0  0.0  22604  2568 pts/0    S+   10:37   0:00 /bin/systemctl start docker.service
root     22386  0.0  0.1 488432 30148 ?        Ssl  10:37   0:00 /usr/bin/dockerd -H fd://
root     22392  0.0  0.0 348940 10840 ?        Ssl  10:37   0:00 docker-containerd -l unix:///var/run/docker/libcontainerd/docker-containerd.sock --shim docker-containerd-shim --metrics-interval=0 --start-timeout 2m --state-dir /var/run/docker/libcontainerd/containerd --runtime docker-runc
root     22416  0.0  0.0   4220  1240 ?        D    10:38   0:00 auplink /var/lib/docker/aufs/mnt/013c4159a549d19ce422594143a77fe0d15e8707ec46e9def418ed3856d42a1c flush

napad co jsem mel jeste vypnout/sestrelit/smazat? jestli je to stejne jako vcera, zpravidla koncim fyzickym vypnutim stroje, pac se mi nechce vypnout ani system :(

v 'var/log/daemon.log' je z vypnuti tohle:

Aug 23 10:25:21 no-swi-sc-0135 dockerd[779]: time="2016-08-23T10:25:21.042916378+02:00" level=error msg="containerd: notify OOM events" error="cgroup path for memory not found"
Aug 23 10:34:57 no-swi-sc-0135 dockerd[779]: time="2016-08-23T10:34:57.213134087+02:00" level=info msg="Container ae0b58d8ad5bc02f73fe97e1ab32ee7471200a3cb9a65c2f844aee98b67bc071 failed to exit within 10 seconds of signal 15 - using the f
Aug 23 10:35:17 no-swi-sc-0135 dockerd[779]: time="2016-08-23T10:35:17.640411912+02:00" level=info msg="Container b6d11f752f3f failed to exit within 10 seconds of kill - trying direct SIGKILL"
Aug 23 10:36:32 no-swi-sc-0135 dockerd[779]: time="2016-08-23T10:36:32.113225517+02:00" level=info msg="Processing signal 'terminated'"
Aug 23 10:36:42 no-swi-sc-0135 dockerd[779]: time="2016-08-23T10:36:42.114555508+02:00" level=info msg="Container b6d11f752f3fff571f069e63e6758d473bf81fdc82ec1a7337b5d9ffff4cae24 failed to exit within 10 seconds of signal 15 - using the force"
Aug 23 10:36:47 no-swi-sc-0135 dockerd[779]: time="2016-08-23T10:36:47.113666797+02:00" level=error msg="Force shutdown daemon"
Aug 23 10:36:47 no-swi-sc-0135 dockerd[779]: time="2016-08-23T10:36:47.114128243+02:00" level=info msg="stopping containerd after receiving terminated"
Aug 23 10:36:48 no-swi-sc-0135 dockerd[779]: time="2016-08-23T10:36:48.005482221+02:00" level=error msg="collecting stats for b6d11f752f3fff571f069e63e6758d473bf81fdc82ec1a7337b5d9ffff4cae24: rpc error: code = 2 desc = grpc: the client connection is closing"

a novy pusteni

Aug 23 10:37:50 no-swi-sc-0135 dockerd[22386]: time="2016-08-23T10:37:50.151648747+02:00" level=info msg="libcontainerd: new containerd process, pid: 22392"
Aug 23 10:37:50 no-swi-sc-0135 dockerd[22386]: time="2016-08-23T10:37:50.170847933+02:00" level=error msg="containerd: notify OOM events" error="cgroup path for memory not found"
Aug 23 10:37:51 no-swi-sc-0135 dockerd[22386]: time="2016-08-23T10:37:51.156712215+02:00" level=info msg="[graphdriver] using prior storage driver \"aufs\""
Aug 23 10:37:51 no-swi-sc-0135 dockerd[22386]: time="2016-08-23T10:37:51.184606710+02:00" level=info msg="Graph migration to content-addressability took 0.00 seconds"
Aug 23 10:37:51 no-swi-sc-0135 dockerd[22386]: time="2016-08-23T10:37:51.184811556+02:00" level=warning msg="Your kernel does not support cgroup memory limit"
Aug 23 10:37:51 no-swi-sc-0135 dockerd[22386]: time="2016-08-23T10:37:51.184849131+02:00" level=warning msg="Your kernel does not support cgroup cfs period"
Aug 23 10:37:51 no-swi-sc-0135 dockerd[22386]: time="2016-08-23T10:37:51.184867080+02:00" level=warning msg="Your kernel does not support cgroup cfs quotas"
Aug 23 10:37:51 no-swi-sc-0135 dockerd[22386]: time="2016-08-23T10:37:51.184976453+02:00" level=warning msg="mountpoint for pids not found"
Aug 23 10:37:51 no-swi-sc-0135 dockerd[22386]: time="2016-08-23T10:37:51.185467441+02:00" level=info msg="Loading containers: start."
(END)

zdravim, s dockerem zacinam a jsem jenom vyvojar, takze mozna to ze mne budete muset trosku lamat :[

kazdopadne v mem prostredi (debian 8) mi zamrzava kontejner s mariadb, prestane komunikovat, nezere pamet, ale neda se vypnout ..
- docker-compose stop timeoutuje
-docker stop/rm -f trva nekonecne dlouho
- v kontejneru je akorat defunct mysqld
- pstree:

        ├─dockerd─┬─docker-containe─┬─docker-containe─┬─run.sh───mysqld─┬─mysqld
        │         │                 │                 │                 └─{mysqld}
        │         │                 │                 └─9*[{docker-containe}]
        │         │                 └─15*[{docker-containe}]
        │         ├─docker-proxy───4*[{docker-proxy}]
        │         └─20*[{dockerd}]

- v ps vidim i ty zamrzly mysqld, i ten docker:

999       8837  0.0  0.0      0     0 ?        Zl   09:54   0:00 [mysqld] <defunct>
999      11732  0.0  0.0      0     0 ?        Z    10:12   0:00 [mysqld] <defunct>
root       795  0.0  0.2 991556 46780 ?        Ssl  Aug19   1:50 /usr/bin/dockerd -H fd://
root       851  0.0  0.0 606348 11672 ?        Ssl  Aug19   0:11 docker-containerd -l unix:///var/run/docker/libcontainerd/docker-containerd.sock --shim docker-containerd-shim --metrics-interval=0 --start-timeout 2m --state-dir /var/run/docker/libcontainerd/containerd --runtime docker-runc
snek      8535  0.0  0.0   9648  2536 pts/1    S+   09:54   0:00 docker-compose up
snek      8536  0.3  0.1 616344 25312 pts/1    Sl+  09:54   0:24 docker-compose up
root      8633  0.0  0.0  43492  3592 ?        Sl   09:54   0:00 /usr/bin/docker-proxy -proto tcp -host-ip 0.0.0.0 -host-port 3306 -container-ip 172.17.0.2 -container-port 3306
root      8725  0.0  0.0 349360  3744 ?        Sl   09:54   0:00 docker-containerd-shim 4f6a7e3620c34035883ea9c016690d336bc2686e6fc9186bc070ee09f6bb4b0b /var/run/docker/libcontainerd/4f6a7e3620c34035883ea9c016690d336bc2686e6fc9186bc070ee09f6bb4b0b docker-runc

- /etc/init.d/docker stop vypne docker, ale ten docker-containerd-shim tam zustane, takze ho musim zabit jeste solo s -9
- ve vystupu z dockere compose to konci nejakyma deadlockama z mariadb

takze muj obecny dotaz, tusite o nejakych 'well known' issues s mariadb na 64bit debianu? nejak nic nemuzu vygooglit .. pripadne kudy mam pokracovat v patrani? zjistit co za image to pouziva? ten clovek co to tu nastavoval jede navic na widlich, mel s tim taky problemy nez presel z virtualboxu na vmware