o usuário systemd não pode obter a capacidade do grupo de usuários

8

Eu adicionei um usuário não raiz ao grupo de encaixe e um outro serviço é executado conforme esse usuário não raiz se conecta ao daemon do docker. mas o serviço não pode funcionar. Eu faço um exemplo de teste para isso:

root@# systemctl start docker.service 
root@# gpasswd -a tiger docker

crie um serviço systemd no tigre:

[Service]
ExecStart=/home/tiger/connectdocker
Restart=always
StartLimitInterval=0
Delegate=true
KillMode=process
[Install]
WantedBy=default.target

o /home/tiger/connectdocker assim:

docker run -itd busybox 2> connectdocker.log

inicie este serviço:

tiger@# systemctl --user enable connectdocker.service
tiger@# systemctl --user start connectdocker.service

e o resultado:

Thu Jul 21 00:59:15 CST 2016
Cannot connect to the Docker daemon. Is the docker daemon running on this host?

mas eu posso conectar ao docker.sock com o tigre:

tiger@# docker run -itd busybox
997e99f959cfd5500319935ec17677775da9d367d203a11efef8b42161c3ee64

para provar isso, mudo o grupo /var/run/docker.sock do docker para o tiger, e o serviço connectdocker pode se conectar ao daemon do docker.

altere /var/run/docker.sock :

ls -l /run/docker.sock
srw-rw---- 1 root docker 0 Jul 21 00:33 /run/docker.sock

para:

ls -l /run/docker.sock
srw-rw---- 1 root tiger 0 Jul 21 00:33 /run/docker.sock
    
por yongsu zhang 20.07.2016 / 18:49

1 resposta

1

Você deve usar a diretiva User= no seu serviço systemd .

User=, Group=

Set the UNIX user or group that the processes are executed as, respectively. Takes a single user or group name, or numeric ID as argument. For system services (services run by the system service manager, i.e. managed by PID 1) and for user services of the root user (services managed by root's instance of systemd --user), the default is "root", but User= may be used to specify a different user. For user services of any other user, switching user identity is not permitted, hence the only valid setting is the same user the user's service manager is running as. If no group is set, the default group of the user is used. This setting does not affect commands whose command line is prefixed with "+".

link

Também recomendo mover seu script de um diretório inicial para um caminho padrão, como /usr/local/bin ou algo parecido.

Você também deve garantir a encomenda do seu connectdocker.service dando-lhe o After=docker.service e Requires=docker.service . Como está escrito, o connectdocker.service provavelmente está tentando começar no mesmo tempo que o docker.service , e você precisa esperar que o docker.service esteja pronto antes de se conectar a ele.

Requires=

Configures requirement dependencies on other units. If this unit gets activated, the units listed here will be activated as well. If one of the other units gets deactivated or its activation fails, this unit will be deactivated. This option may be specified more than once or multiple space-separated units may be specified in one option in which case requirement dependencies for all listed names will be created. Note that requirement dependencies do not influence the order in which services are started or stopped. This has to be configured independently with the After= or Before= options. If a unit foo.service requires a unit bar.service as configured with Requires= and no ordering is configured with After= or Before=, then both units will be started simultaneously and without any delay between them if foo.service is activated. Often, it is a better choice to use Wants= instead of Requires= in order to achieve a system that is more robust when dealing with failing services.

Note that this dependency type does not imply that the other unit always has to be in active state when this unit is running. Specifically: failing condition checks (such as ConditionPathExists=, ConditionPathExists=, … — see below) do not cause the start job of a unit with a Requires= dependency on it to fail. Also, some unit types may deactivate on their own (for example, a service process may decide to exit cleanly, or a device may be unplugged by the user), which is not propagated to units having a Requires= dependency. Use the BindsTo= dependency type together with After= to ensure that a unit may never be in active state without a specific other unit also in active state (see below).

Note that dependencies of this type may also be configured outside of the unit configuration file by adding a symlink to a .requires/ directory accompanying the unit file. For details, see above.

link

link

    
por 05.04.2017 / 16:14