【发布时间】：2022-11-16 14:33:33
【问题描述】：
我正在尝试使用 AWS ECS Fargate 来运行 JFrog Artifactory。我已经让它在 EC2 实例中正常工作，但 ECS 给我带来了一些问题，我认为与它在容器内运行的 Artifactory 帐户的权限有关，但我不知道为什么会这样在 ECS 内部导致问题，而不是在 EC2 上运行它时，因为它们正在采购相同的 Docker 映像。我在此处附上了带有相关消息的日志，以及我的任务定义。
我尝试过的事情：
- 将工作目录设置为 /usr/jfrog（未更改任何内容）
没有帮助的类似问题：
[shell] [38;5;69m[INFO ][0m [] [installerCommon.sh:1670 ] [main] - Testing directory /opt/jfrog/artifactory/var has read/write permissions for user id 1030
/opt/jfrog/artifactory/app/bin/installerCommon.sh: line 1642: /opt/jfrog/artifactory/var/test-permissions: Permission denied
[shell] [38;5;69m[INFO ][0m [] [installerCommon.sh:1679 ] [main] - /opt/jfrog/artifactory/var DOES NOT have proper permissions for user id 1030
[shell] [38;5;69m[INFO ][0m [] [installerCommon.sh:1680 ] [main] - Directory: /opt/jfrog/artifactory/var, permissions: 755, owner: root, group: root
[shell] [38;5;69m[INFO ][0m [] [installerCommon.sh:1681 ] [main] - Mounted directory must have read/write permissions for user id 1030
[shell] [38;5;197m[ERROR][0m [] [installerCommon.sh:784 ] [main] - Directory /opt/jfrog/artifactory/var has bad permissions for user id 1030
{
"ipcMode": null,
"executionRoleArn": "xxx",
"containerDefinitions": [
{
"dnsSearchDomains": null,
"environmentFiles": null,
"logConfiguration": {
"logDriver": "awslogs",
"secretOptions": null,
"options": {
"awslogs-group": "/ecs/first-run-task-definition",
"awslogs-region": "us-east-1",
"awslogs-stream-prefix": "ecs"
}
},
"entryPoint": [],
"portMappings": [
{
"hostPort": 8082,
"protocol": "tcp",
"containerPort": 8082
},
{
"hostPort": 8081,
"protocol": "tcp",
"containerPort": 8081
},
{
"hostPort": 443,
"protocol": "tcp",
"containerPort": 443
}
],
"command": [],
"linuxParameters": null,
"cpu": 256,
"environment": [],
"resourceRequirements": null,
"ulimits": null,
"dnsServers": null,
"mountPoints": [
{
"readOnly": null,
"containerPath": "/var/opt/jfrog/artifactory",
"sourceVolume": "artifactory-storage"
}
],
"workingDirectory": null,
"secrets": null,
"dockerSecurityOptions": null,
"memory": null,
"memoryReservation": 512,
"volumesFrom": [],
"stopTimeout": null,
"image": "releases-docker.jfrog.io/jfrog/artifactory-pro:latest",
"startTimeout": null,
"firelensConfiguration": null,
"dependsOn": null,
"disableNetworking": null,
"interactive": null,
"healthCheck": null,
"essential": true,
"links": [],
"hostname": null,
"extraHosts": null,
"pseudoTerminal": null,
"user": null,
"readonlyRootFilesystem": null,
"dockerLabels": null,
"systemControls": null,
"privileged": null,
"name": "petclinic-container"
}
],
"memory": "512",
"taskRoleArn": "xxx",
"family": "artifactory",
"pidMode": null,
"requiresCompatibilities": [
"FARGATE"
],
"networkMode": "awsvpc",
"runtimePlatform": null,
"cpu": "256",
"inferenceAccelerators": [],
"proxyConfiguration": null,
"volumes": [
{
"fsxWindowsFileServerVolumeConfiguration": null,
"efsVolumeConfiguration": {
"transitEncryptionPort": null,
"fileSystemId": "xxx",
"authorizationConfig": {
"iam": "DISABLED",
"accessPointId": null
},
"transitEncryption": "ENABLED",
"rootDirectory": "/"
},
"name": "artifactory-storage",
"host": null,
"dockerVolumeConfiguration": null
}
],
"tags": []
}
【问题讨论】：
-
我看到您已在
/var/opt/jfrog/artifactory上安装了 fsx 卷，但错误是说它无法访问已安装的卷/opt/jfrog/artifactory/var。您是否将该卷安装到错误的路径？当您在 EC2 上成功测试时，是否使用了完全相同的 fsx 卷安装配置？ -
@Mark-B 该卷用于数据目录，用于实例之间的持久存储。 /opt/jfrog/artifactory/var 是 artifactory 实际运行的地方，它们完全是 2 个不同的目录。
-
知道了。它们是如此相似，我想确保您没有打错字。如果
/opt/jfrog/artifactory/var是容器镜像的一部分，那么如果您在 EC2 上运行该镜像，或者甚至下载该镜像并在本地运行它，您应该会看到同样的错误。 Fargate 如何处理 docker 镜像中的文件系统并没有什么特别之处。 -
很奇怪...谢谢！希望我能解决这个问题。
标签： docker amazon-ecs artifactory file-permissions aws-fargate