docker - 在无根 docker 容器中运行 HashiCorp Vault

Question

我正在尝试在 Ubuntu 20.2 上使用无根 docker 在容器中运行 Vault。但是，我不断收到以下错误:

vault    | Error initializing core: Failed to lock memory: cannot allocate memory
vault    |
vault    | This usually means that the mlock syscall is not available.

使用具有 root 权限的 docker 运行容器时不会出现此问题。
有没有办法在不禁用 mlock 从而破坏保险库安全性的情况下为无根 docker 提供 mlock 特权？ docker-compose.yml :

version: "3"
services:
  vault:
    image: "hashicorp/vault:1.8.0-rc2"
    user: "root"
    container_name: vault
    restart: on-failure:10
    volumes:
      - ./config:/vault/config:rw
      - ./file:/vault/file:rw
    ports:
      - 8200:8200
    cap_add:
      - IPC_LOCK
    environment:
      - VAULT_ADDR=http://0.0.0.0:8200
    command: vault server -config=/vault/config

config.hcl :

storage "file" {
  path    = "/vault/file"
}

listener "tcp" {
  address     = "0.0.0.0:8200"
  tls_disable = "true"
}

api_addr = "http://127.0.0.1:8200"
ui = true

Answer 1

来自 the documentation :

On Linux, Vault may fail to start with the following error:

Error initializing core: Failed to lock memory: cannot allocate memory

This usually means that the mlock syscall is not available.
Vault uses mlock to prevent memory from being swapped to
disk. This requires root privileges as well as a machine
that supports mlock. Please enable mlock on your system or
disable Vault from using it. To disable Vault from using it,
set the `disable_mlock` configuration option in your configuration
file.

尝试添加 disable_mlock = true给您的 config.hcl像这样的文件:

...
api_addr = "http://127.0.0.1:8200"
ui = true
disable_mlock = true