DB接続やらaws-cliコマンドを使いたいため、それ専用のECSコンテナを作りたいなと思い、Alpine LinuxのImageでsshを起動したところ、以下のようにエラーが出た！ちなみに各コンテナにsshしたい場合はSSMエージェント入れて作業するのが良さそうなのだが！Alpineは対応してなかった！
https://github.com/aws/amazon-ssm-agent/issues/140
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 |
/lib/rc/sh/openrc-run.sh: line 100: can't create /sys/fs/cgroup/blkio/tasks: Read-only file system /lib/rc/sh/openrc-run.sh: line 100: can't create /sys/fs/cgroup/cpu/tasks: Read-only file system /lib/rc/sh/openrc-run.sh: line 100: can't create /sys/fs/cgroup/cpuacct/tasks: Read-only file system /lib/rc/sh/openrc-run.sh: line 100: can't create /sys/fs/cgroup/cpuset/tasks: Read-only file system /lib/rc/sh/openrc-run.sh: line 100: can't create /sys/fs/cgroup/devices/tasks: Read-only file system /lib/rc/sh/openrc-run.sh: line 100: can't create /sys/fs/cgroup/freezer/tasks: Read-only file system /lib/rc/sh/openrc-run.sh: line 100: can't create /sys/fs/cgroup/hugetlb/tasks: Read-only file system /lib/rc/sh/openrc-run.sh: line 100: can't create /sys/fs/cgroup/memory/tasks: Read-only file system /lib/rc/sh/openrc-run.sh: line 100: can't create /sys/fs/cgroup/net_cls/tasks: Read-only file system /lib/rc/sh/openrc-run.sh: line 100: can't create /sys/fs/cgroup/net_prio/tasks: Read-only file system /lib/rc/sh/openrc-run.sh: line 100: can't create /sys/fs/cgroup/perf_event/tasks: Read-only file system /lib/rc/sh/openrc-run.sh: line 100: can't create /sys/fs/cgroup/pids/tasks: Read-only file system /lib/rc/sh/openrc-run.sh: line 100: can't create /sys/fs/cgroup/systemd/tasks: Read-only file system * Starting sshd ... |
ググると以下のようにsedで置換しまくるという方法があるが、まったくエラーは消えることがない。
|
1 2 3 4 5 6 7 |
# sed -i 's/#rc_sys=""/rc_sys="lxc"/g' /etc/rc.conf &&\ > echo 'rc_provide="loopback net"' >> /etc/rc.conf &&\ > sed -i 's/^#\(rc_logger="YES"\)$/\1/' /etc/rc.conf &&\ > sed -i '/tty/d' /etc/inittab &&\ > sed -i 's/hostname $opts/# hostname $opts/g' /etc/init.d/hostname &&\ > sed -i 's/mount -t tmpfs/# mount -t tmpfs/g' /lib/rc/sh/init.sh &&\ > sed -i 's/cgroup_add_service /# cgroup_add_service /g' /lib/rc/sh/openrc-run.sh &&\rm -rf /var/cache/apk/* |
備忘録としてこのエラーを出さない方法をブログします。
■Alpine Linux Init System
https://wiki.alpinelinux.org/wiki/Alpine_Linux_Init_System
https://wiki.alpinelinux.org/wiki/Setting_up_a_ssh-server
Alpine Linuxのinitシステムですが、 openrc を使って制御します。なのでまずはaddしないと起動スクリプトが動きません。以下のように設定しましょう。
- 手順
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 |
bash-5.0# apk add openrc bash-5.0# rc-update add sshd bash-5.0# mkdir /run/openrc && touch /run/openrc/softlevel bash-5.0# rc-status bash-5.0# /etc/init.d/sshd status * status: stopped bash-5.0# /etc/init.d/sshd start /lib/rc/sh/openrc-run.sh: line 100: can't create /sys/fs/cgroup/blkio/tasks: Read-only file system /lib/rc/sh/openrc-run.sh: line 100: can't create /sys/fs/cgroup/cpu/tasks: Read-only file system /lib/rc/sh/openrc-run.sh: line 100: can't create /sys/fs/cgroup/cpuacct/tasks: Read-only file system /lib/rc/sh/openrc-run.sh: line 100: can't create /sys/fs/cgroup/cpuset/tasks: Read-only file system /lib/rc/sh/openrc-run.sh: line 100: can't create /sys/fs/cgroup/devices/tasks: Read-only file system /lib/rc/sh/openrc-run.sh: line 100: can't create /sys/fs/cgroup/freezer/tasks: Read-only file system /lib/rc/sh/openrc-run.sh: line 100: can't create /sys/fs/cgroup/hugetlb/tasks: Read-only file system /lib/rc/sh/openrc-run.sh: line 100: can't create /sys/fs/cgroup/memory/tasks: Read-only file system /lib/rc/sh/openrc-run.sh: line 100: can't create /sys/fs/cgroup/net_cls/tasks: Read-only file system /lib/rc/sh/openrc-run.sh: line 100: can't create /sys/fs/cgroup/net_prio/tasks: Read-only file system /lib/rc/sh/openrc-run.sh: line 100: can't create /sys/fs/cgroup/perf_event/tasks: Read-only file system /lib/rc/sh/openrc-run.sh: line 100: can't create /sys/fs/cgroup/pids/tasks: Read-only file system /lib/rc/sh/openrc-run.sh: line 100: can't create /sys/fs/cgroup/systemd/tasks: Read-only file system * Starting sshd ... [ ok ] bash-5.0# pgrep ssh 45 |
上記のようにエラーが出ているが、sshdはちゃんと動いていますね。次はエラーを潰しましょう。
- /lib/rc/sh/openrc-run.sh
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 |
for _cmd; do if [ "$_cmd" != status -a "$_cmd" != describe ]; then # Apply any ulimit defined [ -n "${rc_ulimit:-$RC_ULIMIT}" ] && \ ulimit ${rc_ulimit:-$RC_ULIMIT} # Apply cgroups settings if defined if [ "$(command -v cgroup_add_service)" = "cgroup_add_service" ] then if grep -qs /sys/fs/cgroup /proc/1/mountinfo then if [ -d /sys/fs/cgroup -a ! -w /sys/fs/cgroup ]; then eerror "No permission to apply cgroup settings" break fi fi #cgroup_add_service #コメントアウト fi [ "$(command -v cgroup_set_limits)" = "cgroup_set_limits" ] && cgroup_set_limits [ "$(command -v cgroup2_set_limits)" = "cgroup2_set_limits" ] && [ "$_cmd" = start ] && cgroup2_set_limits break fi done |
cgroup_add_service 関数がうまく動いていないので、コメントアウトします。
- 確認
|
1 2 3 4 5 6 7 8 9 10 11 12 |
bash-5.0# /etc/init.d/sshd status * status: started bash-5.0# /etc/init.d/sshd stop * WARNING: you are stopping a sysinit service * Stopping sshd ... [ ok ] bash-5.0# /etc/init.d/sshd start * Starting sshd ... [ ok ] bash-5.0# pgrep sshd 137 |
OK！！
ちなみにDockerfileで作るとこんな感じ。
■Dockerfile
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 |
FROM alpine:3.11 LABEL maintainer adachin_devteam ARG pip_installer="https://bootstrap.pypa.io/get-pip.py" # Setup UTC+9 RUN apk --update add tzdata && \ cp /usr/share/zoneinfo/Asia/Tokyo /etc/localtime && \ apk del tzdata # Install Package RUN apk update && \ apk upgrade && \ apk add --update \ bash \ openssl \ openssl-dev \ openssh \ sudo \ perl \ curl \ curl-dev \ wget \ git \ python \ curl \ groff \ mysql-client \ openrc \ bash \ vim && \ rm -rf /var/cache/apk/* # Install awscli RUN curl ${pip_installer} | python && \ pip install awscli # Create adachin user RUN apk add sudo RUN adduser -D adachin RUN sed -ri 's/^wheel:x:10:/wheel:x:10:adachin/' /etc/group RUN sed -ri 's/^# %wheel/adachin/' /etc/sudoers RUN sed -ri '85 s/adachin/#adachin/' /etc/sudoers COPY shadow /etc/ COPY .vimrc /root/ COPY .vimrc /home/adachin/ COPY prompt.sh /etc/profile.d/ RUN echo Set disable_coredump false > /etc/sudo.conf # Setup ssh RUN sed -ri 's/^#Port 22/Port 22222/' /etc/ssh/sshd_config RUN sed -ri 's/^#PermitEmptyPasswords no/PermitEmptyPasswords yes/' /etc/ssh/sshd_config RUN sed -ri 's/^#PermitRootLogin yes/PermitRootLogin yes/' /etc/ssh/sshd_config RUN sed -ri 's/^UsePAM yes/UsePAM no/' /etc/ssh/sshd_config RUN sed -ri 's/^#PermitUserEnvironment no/PermitUserEnvironment no/' /etc/ssh/sshd_config RUN sed -ri '269 s/cgroup_add_service/#cgroup_add_service/' /lib/rc/sh/openrc-run.sh RUN rc-update add sshd RUN mkdir /run/openrc && touch /run/openrc/softlevel RUN rc-status COPY ./service.sh /root/ RUN chmod 744 /root/service.sh # Service to run CMD ["/root/service.sh"] |
■まとめ
これは公式でopenrc-run.shを直してほしい。。
むしろ /usr/sbin/sshd -D でsupervisor使えばいいのでは..
0件のコメント