将Elasticsearch作为奇点容器启动时出现权限拒绝错误

Question

我正在尝试在HPC集群上运行单节点Elasticsearch实例。为此，我将Elasticsearch docker容器转换为奇点容器。当我启动容器本身时，我得到以下错误:

$ singularity exec --overlay overlay.img elastic.sif /usr/share/elasticsearch/bin/elasticsearch
Could not create auto-configuration directory
Exception in thread "main" java.lang.RuntimeException: starting java failed with [1]
output:
[0.000s][error][logging] Error opening log file 'logs/gc.log': Permission denied
[0.000s][error][logging] Initialization of output 'file=logs/gc.log' using options 'filecount=32,filesize=64m' failed.
error:
Invalid -Xlog option '-Xlog:gc*,gc+age=trace,safepoint:file=logs/gc.log:utctime,pid,tags:filecount=32,filesize=64m', see error log for details.
Error: Could not create the Java Virtual Machine.
Error: A fatal exception has occurred. Program will exit.
at org.elasticsearch.server.cli.JvmOption.flagsFinal(JvmOption.java:113)
at org.elasticsearch.server.cli.JvmOption.findFinalOptions(JvmOption.java:80)
at org.elasticsearch.server.cli.MachineDependentHeap.determineHeapSettings(MachineDependentHeap.java:59)
at org.elasticsearch.server.cli.JvmOptionsParser.jvmOptions(JvmOptionsParser.java:132)
at org.elasticsearch.server.cli.JvmOptionsParser.determineJvmOptions(JvmOptionsParser.java:90)
at org.elasticsearch.server.cli.ServerProcess.createProcess(ServerProcess.java:211)
at org.elasticsearch.server.cli.ServerProcess.start(ServerProcess.java:106)
at org.elasticsearch.server.cli.ServerProcess.start(ServerProcess.java:89)
at org.elasticsearch.server.cli.ServerCli.startServer(ServerCli.java:213)
at org.elasticsearch.server.cli.ServerCli.execute(ServerCli.java:90)
at org.elasticsearch.common.cli.EnvironmentAwareCommand.execute(EnvironmentAwareCommand.java:54)
at org.elasticsearch.cli.Command.mainWithoutErrorHandling(Command.java:85)
at org.elasticsearch.cli.Command.main(Command.java:50)
at org.elasticsearch.launcher.CliToolLauncher.main(CliToolLauncher.java:64)

如果我理解正确，Elasticsearch试图在/var/log/elasticsearch中创建一个日志文件，但没有正确的权限。因此，我创建了以下方法来创建文件夹并设置权限，以便任何进程都可以写入日志目录。我的食谱如下:

Bootstrap: docker
From: elasticsearch:8.3.1
%files
elasticsearch.yml /usr/share/elasticsearch/config/
%post
mkdir -p /var/log/elasticsearch
chown -R elasticsearch:elasticsearch /var/log/elasticsearch
chmod -R 777 /var/log/elasticsearch
mkdir -p /var/data/elasticsearch
chown -R elasticsearch:elasticsearch /var/data/elasticsearch
chmod -R 777 /var/data/elasticsearch

elasticsearch。Yml文件包含以下内容:

cluster.name: "docker-cluster"
network.host: 0.0.0.0
discovery.type: single-node
ingest.geoip.downloader.enabled: false

构建这个配方后，目录/var/log/elasticsearch似乎被正确创建:

$ singularity exec elastic.sif ls -alh /var/log/ 
total 569K
drwxr-xr-x  4 root          root           162 Jul  8 14:43 .
drwxr-xr-x 12 root          root           172 Jul  8 14:43 ..
-rw-r--r--  1 root          root          7.7K Jun 29 17:29 alternatives.log
drwxr-xr-x  2 root          root            69 Jun 29 17:29 apt
-rw-r--r--  1 root          root           58K May 31 11:43 bootstrap.log
-rw-rw----  1 root          utmp             0 May 31 11:43 btmp
-rw-r--r--  1 root          root          187K Jun 29 17:30 dpkg.log
drwxrwxrwx  2 elasticsearch elasticsearch    3 Jul  8 14:43 elasticsearch
-rw-r--r--  1 root          root           32K Jun 29 17:30 faillog
-rw-rw-r--  1 root          utmp          286K Jun 29 17:30 lastlog
-rw-rw-r--  1 root          utmp             0 May 31 11:43 wtmp

但是当我启动容器时，我得到了上面列出的权限拒绝错误。

这里缺少什么?Elasticsearch期待是什么权限?

Answer 1

下面的解决方法现在似乎对我有效:

当启动奇点容器时，elasticsearch进程在容器内执行，其UID与我自己的UID相同(使用singularity exec启动奇点容器的用户)。elasticsearch容器被配置为使用容器内存在的独立用户elasticsearch运行elasticsearch。问题是奇点(不像docker)将使用我自己的UID而不是elasticsearch UID运行容器内的每个进程，导致上面的错误。

为了解决这个问题，我创建了一个基本的ubuntu奇点映像，然后按照安装说明(https://www.elastic.co/guide/en/elasticsearch/reference/current/targz.html)将elasticsearch安装到容器中。因为安装是用我的系统用户和UID执行的，所以整个elasticsearch安装属于我的系统用户，而不是一个单独的elasticsearch用户。然后我可以在容器内启动elasticsearch服务。