docker - 带有用户 namespace 映射的Docker构建和docker-compose构建

Question

我已经在docker中启用了用户 namespace 映射，并使用docker build来构建图像，但是当我对图像使用docker-compose时，它失败并显示以下消息。可能是什么原因呢？

db@vagrant:~/docker$ docker-compose up --build

Building db
Step 1/3 : FROM alpine:latest
 ---> e7d92cdc71fe
Step 2/3 : WORKDIR /app
 ---> Using cache
 ---> 1491149423a1
Step 3/3 : COPY 1.txt .
ERROR: Service 'db' failed to build: failed to copy files: failed to copy file: Container ID 65536 cannot be mapped to a host ID

我的用户ID是由某些安装脚本生成的，导致UID值大于65535。

db@vagrant:~/docker$ id
uid=65536(db) gid=1000(db) groups=1000(db),27(sudo),998(docker)

Docker configuration for namespace mapping

db@vagrant:~/docker$ cat /etc/docker/daemon.json
{
  "userns-remap": "db"
}

db@vagrant:~/docker$ cat /etc/subuid /etc/subgid
db:100000:65536
db:100000:65536

Dockerfile内容(1.txt为空文件)

db@vagrant:~/docker$ cat Dockerfile
FROM alpine:latest
WORKDIR /app
COPY 1.txt .

docker-compose.yml文件内容

db@vagrant:~/docker$ cat docker-compose.yml
version: "2"
services:
   db:
     build:
       context: .
       dockerfile: Dockerfile
     image: sirishkumar/test

docker build命令的输出

db@vagrant:~/docker$ docker build -t sirishkumar/test .
Sending build context to Docker daemon  3.584kB
Step 1/3 : FROM alpine:latest
latest: Pulling from library/alpine
c9b1b535fdd9: Pull complete
Digest: sha256:ab00606a42621fb68f2ed6ad3c88be54397f981a7b70a79db3d1172b11c4367d
Status: Downloaded newer image for alpine:latest
 ---> e7d92cdc71fe
Step 2/3 : WORKDIR /app
 ---> Running in 55f092b96268
Removing intermediate container 55f092b96268
 ---> 8af079e6a478
Step 3/3 : COPY 1.txt .
 ---> b3c14a691102
Successfully built b3c14a691102
Successfully tagged sirishkumar/test:latest

docker-compose的输出

db@vagrant:~/docker$ docker-compose up --build
Creating network "docker_default" with the default driver
Building db
Step 1/3 : FROM alpine:latest
latest: Pulling from library/alpine
c9b1b535fdd9: Pull complete
Digest: sha256:ab00606a42621fb68f2ed6ad3c88be54397f981a7b70a79db3d1172b11c4367d
Status: Downloaded newer image for alpine:latest
 ---> e7d92cdc71fe
Step 2/3 : WORKDIR /app
 ---> Running in fe39955aed1a
Removing intermediate container fe39955aed1a
 ---> fb23b8888f4a
Step 3/3 : COPY 1.txt .
ERROR: Service 'db' failed to build: failed to copy files: failed to copy file: Container ID 65536 cannot be mapped to a host ID

Answer 1

您有65,536个用户ID可以映射到您的docker用户 namespace 中:

db@vagrant:~/docker$ cat /etc/subuid /etc/subgid
db:100000:65536
db:100000:65536

然后，您要告诉docker将文件复制到该ID超出该范围的容器中(用户ID的起始位置为0):

db@vagrant:~/docker$ id
uid=65536(db) gid=1000(db) groups=1000(db),27(sudo),998(docker)

您需要将主机上的用户ID设置为主机用户ID范围内(小于65536)。