OCI 运行时创建失败：container_linux.go:345

Question

目前我们正在从 GitLab 迁移到 GitHub，我们决定将 CI/CD 流程迁移到 GitHub 操作。管道过程就像一个魅力，但当 GKE 尝试启动新推送的图像时，它会返回此错误：

'OCI runtime create failed: container_linux.go:345: starting container process caused "exec: \"/socket-server\": permission denied": unknown'

在此需要注意的是，整个过程都在 GitLab 上运行，这一点很重要。反正 GitHub 工作流 yaml 文件是这样的：

name: Build and deploy
on:
  - push
  - pull_request

jobs:
  build:
    name: Build
    runs-on: ubuntu-latest
    steps:
      - uses: fusion-engineering/setup-git-credentials@v2
        with:
          credentials: https://${{ secrets.MACHINE_ACCOUNT_ACCESS_TOKEN }}:x-oauth-basic@github.com/

      - name: Setup environment
        shell: bash
        run: |
          echo "::set-env name=GOPATH::${{ github.workspace }}/go"
          echo "::add-path::${{ github.workspace }}/go/bin"

      - name: Install Go
        uses: actions/setup-go@v1
        with:
          go-version: 1.12.4

      - name: Checkout code
        uses: actions/checkout@v2
        with:
          path: go/src/github.com/${{ github.repository }}

      - name: Prepare environment
        run: |
          cd $GOPATH/src/github.com/${{ github.repository }}
          make prepare

      - name: Format code
        run: |
          cd $GOPATH/src/github.com/${{ github.repository }}
          make fmt && git diff --exit-code

      - name: Lint code
        run: |
          cd $GOPATH/src/github.com/${{ github.repository }}
          make lint

      - name: Vet code
        run: |
          cd $GOPATH/src/github.com/${{ github.repository }}
          make vet

      - name: Test code
        run: |
          cd $GOPATH/src/github.com/${{ github.repository }}
          make cover

      - name: Build code
        run: |
          cd $GOPATH/src/github.com/${{ github.repository }}
          make build

      - name: Upload artifact
        uses: actions/upload-artifact@v1
        with:
          name: socket-server
          path: go/src/github.com/${{ github.repository }}/socket-server

  deploy:
    name: Deploy
    runs-on: ubuntu-latest
    needs: [build]
    if: contains(github.ref, 'refs/tags')

    steps:
      - name: Set release version
        run: echo ::set-env name=CI_COMMIT_TAG::${GITHUB_REF/refs\/tags\//}

      - name: Checkout code
        uses: actions/checkout@v2

      - name: Get artifact from build step
        uses: actions/download-artifact@v1
        with:
          name: socket-server

      - name: Set ci auth
        run: echo ::set-env name=CI_AUTH::$(cat ci_auth.json | base64)

      - uses: GoogleCloudPlatform/github-actions/setup-gcloud@master
        with:
          service_account_key: ${{ env.CI_AUTH }}

      - name: Configure gcloud docker authentication
        run: |
          gcloud config set project foo
          gcloud auth configure-docker

      - name: Build, push and deploy container
        run: |
          bash deploy.sh

deploy.sh 文件如下所示：

#!/bin/bash

if [[ -z "${CI_COMMIT_TAG}" ]]; then
    echo "CI_COMMIT_TAG is empty, this stage should not run"
    exit 0
fi

export ENV="stage"

if [[ "$CI_COMMIT_TAG" != "${CI_COMMIT_TAG%-release}" ]]; then
    export ENV="prod"
fi

echo "Current environment: $ENV"

make deploy

Makefile 中的部署步骤如下所示：

deploy:
    ( echo "cat <<EOF" ; cat k8s.yml.template; ) | sh > k8s-${ENV}.yml
    docker build --no-cache \
    --build-arg RELEASE=${CI_COMMIT_TAG} \
    --build-arg ENV=${ENV} \
    -t gcr.io/foo/socket-server:${CI_COMMIT_TAG} .
    docker push gcr.io/foo/socket-server:${CI_COMMIT_TAG}
    gcloud container clusters get-credentials api-${ENV} --zone=europe-west1-b
    kubectl apply -f k8s-${ENV}.yml

Dockerfile 看起来像这样：

FROM alpine:latest as certs
RUN apk --update add ca-certificates

FROM scratch
COPY --from=certs /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt

ARG RELEASE
ARG ENV

ADD ./socket-server /socket-server
ADD ./config.yml /config.yml
ADD ./dbconfig.yml /dbconfig.yml
ADD ./migrations /migrations

ENV SOCKET_SERVER_SENTRY_DSN https://foo@sentry.io/bar
ENV SOCKET_SERVER_SENTRY_RELEASE $RELEASE
ENV SOCKET_SERVER_SENTRY_ENVIRONMENT $ENV

CMD ["/socket-server", "--port", "9345", "--host", ""]

我已经尝试在管道和 Dockerfile (as suggested here) 上使用 chmod +x socket-server。当我在 Dockerfile 中执行此操作时，它会失败并出现以下错误：

Step 14/15 : RUN chmod +x socket-server
 ---> Running in 9c66aef0c35b
OCI runtime create failed: container_linux.go:349: starting container process caused "exec: \"/bin/sh\": stat /bin/sh: no such file or directory": unknown

我是否遗漏了 GitHub 工作流程中的某些内容，或者是否有人看到了我没有看到的内容？感谢您的帮助！

Answer 1

您可以在包含 chmod 二进制文件的另一个阶段中运行 chmod，然后将具有更正权限的文件复制到您的最终基于暂存的阶段：

FROM alpine:latest as certs
RUN apk --update add ca-certificates

FROM alpine:latest as binaries
COPY ./socket-server /socket-server
RUN chmod 755 /socket-server

FROM scratch
COPY --from=certs /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt

COPY --from=binaries /socket-server /
COPY ./config.yml /config.yml
COPY ./dbconfig.yml /dbconfig.yml
COPY ./migrations /migrations

ARG RELEASE
ARG ENV

ENV SOCKET_SERVER_SENTRY_DSN https://foo@sentry.io/bar
ENV SOCKET_SERVER_SENTRY_RELEASE $RELEASE
ENV SOCKET_SERVER_SENTRY_ENVIRONMENT $ENV

CMD ["/socket-server", "--port", "9345", "--host", ""]

请注意，我也已从 ADD 切换到 COPY，因为您不想解压缩二进制文件/yml 文件或从远程 http 服务器拉取它们。而且我还将 ARG 条目移到了您使用它们的位置，以避免过早地破坏缓存（这里不是问题，但会使用 RUN 命令）。

Answer 2

所以我发现上传的工件被管道放在一个文件夹中。所以socket-server 是一个目录，而不是预期的可执行文件。我通过更改它来修复它：

- name: Get artifact from build step
        uses: actions/download-artifact@v1
        with:
          name: socket-server

到

- name: Get artifact from build step
        uses: actions/download-artifact@v1
        with:
          name: socket-server
          path: .