docker - 使用非root用户时，Docker Alpine，Celery(worker和beat)失败并出现PermissionError

Question

我正在尝试使用docker-compose在Docker Alpine上使用Celery(worker + beat)运行Flask应用程序。

我希望它在Docker容器中与非root用户celery一起运行。
flask应用程序可以正常运行，但是我的 celery 容器由于以下错误而失败:

 File "/usr/lib/python3.6/site-packages/celery/platforms.py", line 543, in maybe_drop_privileges
    _setuid(uid, gid)
  File "/usr/lib/python3.6/site-packages/celery/platforms.py", line 564, in _setuid
    initgroups(uid, gid)
  File "/usr/lib/python3.6/site-packages/celery/platforms.py", line 507, in initgroups
    return os.initgroups(username, gid)
PermissionError: [Errno 1] Operation not permitted

我的Dockerfile:
我试图添加 RUN chown celery:celery /etc/group认为是问题所在，但仍然失败

FROM alpine:3.8

RUN apk update && \
    apk add build-base python3 python3-dev libffi-dev libressl-dev && \
    cd /usr/bin && \
    ln -sf python3 python && \
    ln -sf pip3 pip && \
    pip install --upgrade pip

COPY requirements.txt .
RUN pip install -r requirements.txt

RUN addgroup celery
RUN adduser celery -G celery -s /bin/sh -D

RUN mkdir -p /var/log/celery/ && chown celery:celery /var/log/celery/
RUN mkdir -p /var/run/celery/ && chown celery:celery /var/run/celery/
RUN chown celery:celery /etc/group  # added to try fixing the issue

USER celery

ENV FLASK_APP=flask_app
WORKDIR app/
COPY flask_app flask_app

我的 docker 组成:

(...)
celeryworker:
    build: .
    command: celery -A flask_app.tasks worker --loglevel=INFO --uid=celery --pidfile=/tmp/celeryworker-shhh.pid

celerybeat:
    build: .
    command: celery -A flask_app.tasks beat --loglevel=INFO --uid=celery --pidfile=/tmp/celerybeat-shhh.pid

Answer 1

如果要使用--uid或--gid参数，您必须是root用户。尝试删除这些参数。