php - 具有自定义 docker 镜像 SSH 的 Azure Web 应用程序

Question

我有一个正在运行 php-apache 的自定义 docker 镜像(来自 php:7.4-apache-bullseye)，通过推送 webhook 从 azure 注册表部署。 Web 应用程序安装了一个用于持久数据的存储。 .png 图像应该从那里提供，但在提供时总是失败并显示 400。它可以在我的本地计算机和具有专用硬件的测试环境上运行。遵循以下文档 (https://learn.microsoft.com/en-us/azure/app-service/configure-custom-container?pivots=container-linux#enable-ssh)

所以我的猜测是通过 ssh 检查应用程序并查看 docker 镜像文件中创建的权限和链接。但是当尝试在容器上启动 ssh 服务时，镜像的部署失败。

这是 Docker 文件

FROM php:7.4-apache-bullseye

RUN apt-get update && \
    apt-get install supervisor cron \
            nano git zip libpq-dev \
            certbot python3-certbot-apache \
            nodejs npm redis-server gnupg gdal-bin wget libzip-dev -y

RUN ln -fs /usr/share/zoneinfo/Europe/Vienna /etc/localtime
RUN docker-php-ext-install pdo pdo_pgsql pgsql gettext zip

COPY api/. /var/www/api/
WORKDIR /var/www/api/

RUN ln -s /var/www/data_persistent/maps /var/www/api/public/maps

RUN ln -fs /var/www/data_persistent/config/.env /var/www/api/.env
RUN mkdir -p /var/www/api/storage/logs && chmod 777 -R /var/www/api/storage
RUN mkdir -p /var/www/api/storage/app/tmp && chmod 777 -R /var/www/api/storage/app/tmp
RUN mkdir -p /var/www/api/storage/app/raw_data && chmod 777 -R /var/www/api/storage/app/raw_data

RUN mkdir -p /var/www/data_persistent/storage/logs

RUN ln -fs /var/www/api/storage/logs /var/www/data_persistent/storage/logs
RUN chmod 777 -R /var/www/data_persistent/storage/logs

RUN php -r "copy('https://getcomposer.org/installer', 'composer-setup.php');"
RUN php composer-setup.php
RUN php -r "unlink('composer-setup.php');"


RUN php -d memory_limit=2G composer.phar --quiet install
RUN php -d memory_limit=2G composer.phar --quiet update


ADD config/cronjobs /var/www/cronjobs
RUN crontab -u www-data /var/www/cronjobs

ADD config/apache/xxx.conf /etc/apache2/sites-available/xxx.conf

RUN a2ensite api.arteria.conf

RUN a2enmod rewrite
RUN a2dissite 000-default

ADD config/php.ini /usr/local/etc/php/conf.d/php.ini
ADD config/supervisor_apache.conf /etc/supervisor/conf.d/apache.conf
ADD config/supervisor_cron.conf /etc/supervisor/conf.d/cron.conf

CMD [ "/usr/bin/supervisord", "-n", "-c", "/etc/supervisor/supervisord.conf" ]

RUN  apt-get install --yes --no-install-recommends openssh-server && echo "root:Docker!" | chpasswd 
COPY sshd_config /etc/ssh/
RUN mkdir -p /temp
COPY ssh_setup.sh /temp
COPY init.sh /usr/local/bin/
RUN chmod u+x /usr/local/bin/init.sh
RUN chmod +x /temp/ssh_setup.sh && (sleep 1;/temp/ssh_setup.sh 2>&1 > /dev/null)

EXPOSE 80 2222
# if this is used the app won't start
# ENTRYPOINT ["init.sh"]

在运行 sshd 的情况下，我得到 az_command_data_logger: SSH is notenabled for this app。要启用 SSH，请按照以下说明操作:https://go.microsoft.com/fwlink/?linkid=2132395尝试通过 az webapp create-remote-connection 进行 ssh 时通过 azure 门户它也不起作用。我尝试通过不同的方法启动 ssh:在 Web 应用程序门户中，通过配置 > 常规设置 > 启动命令 service ssh start 下的启动命令或通过部署中心下的启动文件或命令或者通过上面的 dockerfile 中的 init.sh

init.sh

#!/bin/bash
set -e

echo "Starting SSH ..."
service ssh start
# service apache2 start

执行服务 ssh start 时，我得到以下输出:

docker run -d --expose=8081 --name webapp_msiProxy -e WEBSITE_ROLE_INSTANCE_ID=0 -e WEBSITE_HOSTNAME=webapp -e WEBSITE_INSTANCE_ID=e262ff50b02bc79dfcf96feacb75832df6ff0f14dccff63ca6ee6cb3eb18fb7d -e HTTP_LOGGING_ENABLED=1 -e WEBSITE_USE_DIAGNOSTIC_SERVER=False mcr.microsoft.com/appsvc/msitokenservice:stage5
ca6ee6cb3eb18fb7d -e HTTP_LOGGING_ENABLED=1 -e WEBSITE_USE_DIAGNOSTIC_SERVER=False xxx.azurecr.io/xxx.img:latest service ssh start
2022-07-29T10:45:56.254Z INFO  - Initiating warmup request to container webapp_msiProxy for site webapp-test
2022-07-29T10:45:56.268Z INFO  - Container webapp_msiProxy for site webapp-test initialized successfully and is ready to serve requests.
2022-07-29T10:45:56.269Z INFO  - Initiating warmup request to container webapp for site webapp-test
2022-07-29T10:45:55.683051217Z Starting OpenBSD Secure Shell server: sshd.
2022-07-29T10:46:26.288Z ERROR - Container webapp for site webapp-test has exited, failing site start
2022-07-29T10:46:26.342Z ERROR - Container webapp didn't respond to HTTP pings on port: 80, failing site start. See container logs for debugging.
2022-07-29T10:46:26.349Z INFO  - Stopping site webapp-test because it failed during startup.

这是没有 ssh 的输出:

docker run -d --expose=8081 --name xxx-webapp_0_ff4e7ae0_msiProxy -e WEBSITE_ROLE_INSTANCE_ID=0 -e WEBSITE_HOSTNAME=xxx-webapp.azurewebsites.net -e WEBSITE_INSTANCE_ID=e262ff50b02bc79dfcf96feacb75832df6ff0f14dccff63ca6ee6cb3eb18fb7d -e HTTP_LOGGING_ENABLED=1 -e WEBSITE_USE_DIAGNOSTIC_SERVER=False mcr.microsoft.com/appsvc/msitokenservice:stage5
ca6ee6cb3eb18fb7d -e HTTP_LOGGING_ENABLED=1 -e WEBSITE_USE_DIAGNOSTIC_SERVER=False xxx.azurecr.io/xxx.img:latest
2022-07-29T10:48:34.739Z INFO  - Initiating warmup request to container xxx-webapp_0_ff4e7ae0_msiProxy for site xxx-webapp
2022-07-29T10:48:34.779Z INFO  - Container xxx-webapp_0_ff4e7ae0_msiProxy for site xxx-webapp initialized successfully and is ready to serve requests.
2022-07-29T10:48:34.787Z INFO  - Initiating warmup request to container xxx-webapp_0_ff4e7ae0 for site xxx-webapp
2022-07-29T10:48:42.885Z INFO  - Container xxx-webapp_0_ff4e7ae0 for site xxx-webapp initialized successfully and is ready to serve requests.
2022-07-29T10:48:35.227542248Z 2022-07-29 12:48:35,227 CRIT Supervisor is running as root.  Privileges were not dropped because no user is specified in the config file.  If you intend to run as root, you can set user=root in the config file to avoid this message.
2022-07-29T10:48:35.228230140Z 2022-07-29 12:48:35,227 INFO Included extra file "/etc/supervisor/conf.d/apache.conf" during parsing
2022-07-29T10:48:35.228240839Z 2022-07-29 12:48:35,227 INFO Included extra file "/etc/supervisor/conf.d/cron.conf" during parsing
2022-07-29T10:48:35.238925508Z 2022-07-29 12:48:35,238 INFO RPC interface 'supervisor' initialized
2022-07-29T10:48:35.239285403Z 2022-07-29 12:48:35,239 CRIT Server 'unix_http_server' running without any HTTP authentication checking
2022-07-29T10:48:35.239799097Z 2022-07-29 12:48:35,239 INFO supervisord started with pid 1
2022-07-29T10:48:36.242902830Z 2022-07-29 12:48:36,242 INFO spawned: 'apache' with pid 6
2022-07-29T10:48:36.248647159Z 2022-07-29 12:48:36,248 INFO spawned: 'crond' with pid 7
2022-07-29T10:48:36.318576997Z 2022-07-29 12:48:36,318 INFO exited: crond (exit status 0; not expected)
2022-07-29T10:48:38.121554193Z 2022-07-29 12:48:38,117 INFO success: apache entered RUNNING state, process has stayed up for > than 1 seconds (startsecs)
2022-07-29T10:48:38.121575092Z 2022-07-29 12:48:38,119 INFO spawned: 'crond' with pid 24
2022-07-29T10:48:38.142769832Z 2022-07-29 12:48:38,142 INFO exited: crond (exit status 1; not expected)
2022-07-29T10:48:40.151821925Z 2022-07-29 12:48:40,151 INFO spawned: 'crond' with pid 25
2022-07-29T10:48:40.165754654Z 2022-07-29 12:48:40,165 INFO exited: crond (exit status 1; not expected)
2022-07-29T10:48:43.183743813Z 2022-07-29 12:48:43,183 INFO spawned: 'crond' with pid 27
2022-07-29T10:48:43.199486212Z 2022-07-29 12:48:43,199 INFO exited: crond (exit status 1; not expected)
2022-07-29T10:48:43.206808218Z 2022-07-29 12:48:43,206 INFO gave up: crond entered FATAL state, too many start retries too quickly
2022-07-29T10:48:28.166356219Z Warning! Cannot copy to bundle: /usr/local/share/ca-certificates/azure
2022-07-29T10:48:28.277052555Z WARNING: ca-certificates.crt does not contain exactly one certificate or CRL: skipping
2022-07-29T10:48:28.277948042Z WARNING: ca-cert-azure.pem does not contain exactly one certificate or CRL: skipping
2022-07-29T10:48:28.327528842Z Updated CA certificates
2022-07-29T10:48:30.698311225Z xxx-webapp : [00000000-0000-0000-0000-000000000000] Configuration update started. Site: xxx-webapp
2022-07-29T10:48:30.726927164Z xxx-webapp : [00000000-0000-0000-0000-000000000000] [SystemAssigned] Added Identity with ClientId: xxx
2022-07-29T10:48:30.736592542Z xxx-webapp : [00000000-0000-0000-0000-000000000000] Starting TokenService version 2.0.1.3 from /app with the LinuxDedicated SKU. Environment check: IsLinuxDedicated: True, IsLinuxConsumption: False, IsContainerApps: False, IsWindows: False.
2022-07-29T10:48:30.826680307Z Hosting environment: Production
2022-07-29T10:48:30.827249799Z Content root path: /app
2022-07-29T10:48:30.827698194Z Now listening on: http://[::]:8081
2022-07-29T10:48:30.827708094Z Application started. Press Ctrl+C to shut down.
2022-07-29T10:48:31.777800925Z xxx-webapp : [b88231af-dab1-43db-9923-652be3046246] Incoming request on /healthcheck?api-version=2021-08-01
2022-07-29T10:48:31.787418304Z xxx-webapp : [b88231af-dab1-43db-9923-652be3046246] Request to TokenService: Endpoint x.x.x.x, Port 8081, Path /healthcheck, Query ?api-version=2021-08-01, Method GET, UserAgent HealthCheck/1.0
2022-07-29T10:48:32.010089499Z xxx-webapp : [b88231af-dab1-43db-9923-652be3046246] Returning response for Site , Endpoint x.x.x.x, Port 8081, Path /healthcheck, Method GET, Result = 200
2022-07-29T10:48:34.787364778Z xxx-webapp : [eb1f772a-fb57-463d-95cb-6e0e80859348] Incoming request on /robots933456.txt
2022-07-29T10:48:34.787391378Z xxx-webapp : [eb1f772a-fb57-463d-95cb-6e0e80859348] Request to TokenService: Endpoint x.x.x.x, Port 8081, Path /robots933456.txt, Query , Method GET, UserAgent HealthCheck/1.0
2022-07-29T10:48:34.787396478Z xxx-webapp : [eb1f772a-fb57-463d-95cb-6e0e80859348] Returning response for Site , Endpoint x.x.x.x, Port 8081, Path /robots933456.txt, Method GET, Result = 404

感谢您对此的任何想法或指导。

Answer 1

我发现这个问题是一个相当漫长的过程。
这是 docker 文件中的 CMD 行，不再使用 ENTRYPOINT 指令执行，并且容器在执行脚本后刚刚关闭(因为不再运行前台任务)。
我必须删除 CMD 指令并将其添加到 init.sh 中，同时还从 bin/bash 移动到 bin/sh:

#!/bin/sh
set -e
ssh-keygen -A
#prepare run dir
if [ ! -d "/var/run/sshd" ]; then
  mkdir -p /var/run/sshd
fi

echo "Starting SSH ..."
service ssh start

/usr/bin/supervisord -n -c /etc/supervisor/supervisord.conf
exec "$@"