麒麟V10版本使用最新版docker 20.10 后启动容器时出现了未知的权限问题

麒麟V10版本使用最新版docker 20.10 后启动容器时出现了未知的权限问题

1.添加并启动容器时有如下报错

+ docker run -v /data/docker03/input:/input:z -e oper=add -e zcbus=qz_test2 -e zctype=zcbus -e customerid=0 -e kafka_server=198.221.14.201:11010,198.221.14.201:12010,198.221.14.201:13010,198.221.14.201:14010,198.221.14.201:15010 -e customerkey= -e customerurl=http://v2.zbomc.com -e machine_code=e94045f2-d8a7-11ee-b370-e8611a1850e3 -e auto_aux_start=0 -e db_server=QFlYT0k6/YHl4b2l6V0NJS1Z6CwgJCgw6@zcbusnet03:33061/zcbus -e method=integrate -e if_en_version=0 -e zc_ipaddress=198.189.10.159 -e zc_serv_localtion=1 -e zc_version=docker03 -e remoteips=98.221.14.201:16010 -e nodeips=198.221.14.201 -e http_port= -e server_id=2 -e install_mode=0 -e cache_mode=kafka_cache -e http_mode=http -e com_code=-1 -v /data/docker03/yaml/:/compose_location:z -v /:/hostfs:z reg.zbomc.com/zcbus/prepare:latest
docker: Error response from daemon: OCI runtime create failed: container_linux.go:318: starting container process caused "permission denied": unknown.
ERRO[0000] error waiting for container: context canceled

报错原因：

使用最新版 20.10 启动容器时出现了未知的权限问题，退回到docker 19.03 版本。

20.10 版本错误信息如下：

docker: Error response from daemon: OCI runtime create failed: container_linux.go:318: starting container process caused “permission denied”: unknown.
ERRO[0000] error waiting for container: context canceled

2.报错环境信息

[root@node02 docker03]# cat /etc/os-release 
NAME="Kylin Linux Advanced Server"
VERSION="V10 (Lance)"
ID="kylin"
VERSION_ID="V10"
PRETTY_NAME="Kylin Linux Advanced Server V10 (Lance)"
ANSI_COLOR="0;31"

[root@node02 docker03]# uname -a
Linux node02 4.19.90-52.22.v2207.ky10.x86_64 #1 SMP Tue Mar 14 12:19:10 CST 2023 x86_64 x86_64 x86_64 GNU/Linux

[root@node02 docker03]# lscpu
Architecture:                    x86_64
CPU op-mode(s):                  32-bit, 64-bit
Byte Order:                      Little Endian
Address sizes:                   48 bits physical, 48 bits virtual
CPU(s):                          128
On-line CPU(s) list:             0-127
Thread(s) per core:              2
Core(s) per socket:              32
Socket(s):                       2
NUMA node(s):                    8
Vendor ID:                       HygonGenuine
CPU family:                      24
Model:                           3
Model name:                      Hygon C86 7390 32-core Processor
Stepping:                        0
CPU MHz:                         2926.659
BogoMIPS:                        5399.93
Virtualization:                  AMD-V
L1d cache:                       2 MiB
L1i cache:                       4 MiB
L2 cache:                        32 MiB
L3 cache:                        128 MiB
NUMA node0 CPU(s):               0-7,64-71
NUMA node1 CPU(s):               8-15,72-79
NUMA node2 CPU(s):               16-23,80-87
NUMA node3 CPU(s):               24-31,88-95
NUMA node4 CPU(s):               32-39,96-103
NUMA node5 CPU(s):               40-47,104-111
NUMA node6 CPU(s):               48-55,112-119
NUMA node7 CPU(s):               56-63,120-127
Vulnerability Itlb multihit:     Not affected
Vulnerability L1tf:              Not affected
Vulnerability Mds:               Not affected
Vulnerability Meltdown:          Not affected
Vulnerability Mmio stale data:   Not affected
Vulnerability Spec store bypass: Mitigation; Speculative Store Bypass disabled via prctl and seccomp
Vulnerability Spectre v1:        Mitigation; usercopy/swapgs barriers and __user pointer sanitization
Vulnerability Spectre v2:        Mitigation; Retpolines, IBPB conditional, STIBP disabled, RSB filling, PBRSB-e
                                 IBRS Not affected
Vulnerability Srbds:             Not affected
Vulnerability Tsx async abort:   Not affected
Flags:                           fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflus
                                 h mmx fxsr sse sse2 ht syscall nx mmxext fxsr_opt pdpe1gb rdtscp lm constant_t
                                 sc rep_good nopl nonstop_tsc cpuid extd_apicid amd_dcm aperfmperf pni pclmulqd
                                 q monitor ssse3 fma cx16 sse4_1 sse4_2 movbe popcnt aes xsave avx f16c rdrand 
                                 lahf_lm cmp_legacy svm extapic cr8_legacy abm sse4a misalignsse 3dnowprefetch 
                                 osvw skinit wdt tce topoext perfctr_core perfctr_nb bpext perfctr_llc mwaitx c
                                 pb hw_pstate ssbd ibpb vmmcall fsgsbase bmi1 avx2 smep bmi2 rdseed adx smap cl
                                 flushopt sha_ni xsaveopt xsavec xgetbv1 xsaves clzero irperf xsaveerptr arat n
                                 pt lbrv svm_lock nrip_save tsc_scale vmcb_clean flushbyasid decodeassists paus
                                 efilter pfthreshold avic v_vmsave_vmload vgif overflow_recov succor smca

3.处理办法

参考：https://blog.csdn.net/songxi_bo/article/details/125182852