linux - 带有 -u 选项的 useradd 导致 docker 挂起

Question

我有以下 docker 文件

FROM ubuntu:18.04

ARG user_id
ARG user_gid

# Essential packages for building on a Ubuntu host
# https://docs.yoctoproject.org/ref-manual/system-requirements.html#ubuntu-and-debian
# Note, we set DEBIAN_FRONTEND=noninteractive prior to the call to apt-get
# install because otherwise we'll get prompted to select a timezone when the
# tzdata package gets included as a dependency.
RUN apt-get update && DEBIAN_FRONTEND=noninteractive apt-get install -y    \
    gawk wget git-core diffstat unzip texinfo gcc-multilib build-essential \
    chrpath socat cpio python3 python3-pip python3-pexpect xz-utils        \
    debianutils iputils-ping python3-git python3-jinja2 libegl1-mesa       \
    libsdl1.2-dev pylint3 xterm python3-subunit mesa-common-dev sudo

# Add a user and set them up for passwordless sudo. We're using the same user
# ID and group numbers as the host system. This allows us to give the yocto
# user ownership of files and directories in the poky volume we're going to add
# without needing to change ownership which would also affect the host system.
RUN groupadd -g $user_gid yoctouser
RUN useradd -m yoctouser -u $user_id -g $user_gid
    #echo "yoctouser ALL=(ALL:ALL) NOPASSWD:ALL" | tee -a /etc/sudoers

USER yoctouser
WORKDIR /home/yoctouser

ENV LANG=en_US.UTF-8

CMD /bin/bash

useradd 命令挂起，特别是 -u选项是问题。如果我删除 -u $user_id一切正常。此外，docker 正在填满我的磁盘。 /var/lib/docker/overlay2/在添加 -u 之前从 852MB 变为几秒钟后选择千兆字节。如果我不杀死它，它会完全填满我的磁盘，我最终不得不停止 docker 守护进程并手动删除 overlay2 目录中的文件夹。
为什么指定此 uid 可能会成为问题？
这是我为驱动它而编写的 python 脚本的相关部分，因此您可以看到我如何获取用户 ID 并将其传递给 docker build .

def build_docker_image():
    print("Building a docker image named:", DOCKER_IMAGE_NAME)
    USERID_ARG  = "user_id=" + str(os.getuid())
    USERGID_ARG = "user_gid=" + str(os.getgid())
    print(USERID_ARG)
    print(USERGID_ARG)
    try:
        subprocess.check_call(['docker', 'build',
                               '--build-arg', USERID_ARG,
                               '--build-arg', USERGID_ARG,
                               '-t', DOCKER_IMAGE_NAME, '.',
                               '-f', DOCKERFILE_NAME])
    except:
        print("Failed to create the docker image")
        sys.exit(1)

FWIW，在我的系统上

user_id=1666422094
user_gid=1666400513

我正在运行 Docker 版本 20.10.5，在 Ubuntu 18.04 主机上构建 55c4c88。

Answer 1

我需要使用 -l/--no-log-init调用 useradd 时的选项解决方法 bug in docker与如何处理大型 UID 有关。
我最终的 dockerfile 看起来像

FROM ubuntu:18.04

ARG user_id
ARG user_gid

# Essential packages for building on a Ubuntu host
# https://docs.yoctoproject.org/ref-manual/system-requirements.html#ubuntu-and-debian
# Note, we set DEBIAN_FRONTEND=noninteractive prior to the call to apt-get
# install because otherwise we'll get prompted to select a timezone when the
# tzdata package gets included as a dependency.
RUN apt-get update && DEBIAN_FRONTEND=noninteractive apt-get install -y    \
    gawk wget git-core diffstat unzip texinfo gcc-multilib build-essential \
    chrpath socat cpio python3 python3-pip python3-pexpect xz-utils        \
    debianutils iputils-ping python3-git python3-jinja2 libegl1-mesa       \
    libsdl1.2-dev pylint3 xterm python3-subunit mesa-common-dev

# Set up locales
RUN apt-get install -y locales
RUN dpkg-reconfigure locales && \
    locale-gen en_US.UTF-8 &&   \
    update-locale LC_ALL=en_US.UTF-8 LANG=en_US.UTF-8
ENV LC_ALL=en_US.UTF-8
ENV LANG=en_US.UTF-8
ENV LANGUAGE=en_US.UTF-8

# Add a user and set them up for passwordless sudo. We're using the same user
# ID and group numbers as the host system. This allows us to give the yocto
# user ownership of files and directories in the poky mount we're going to add
# without needing to change ownership which would also affect the host system.
# Note the use of the --no-log-init option for useradd. This is a workaround to
# [a bug](https://github.com/moby/moby/issues/5419) relating to how large UIDs
# are handled.
RUN apt-get install -y sudo &&                                           \
    groupadd --gid ${user_gid} yoctouser &&                              \
    useradd --create-home --no-log-init --uid ${user_id} --gid yoctouser \
        yoctouser &&                                                     \
    echo "yoctouser ALL=(ALL:ALL) NOPASSWD:ALL" | tee -a /etc/sudoers

USER yoctouser
WORKDIR /home/yoctouser

CMD ["/bin/bash"]