带有用户命名空间映射的 Docker 构建和 docker-compose 构建

Question

我已经在 docker 中启用了用户命名空间映射并使用 docker build 构建了一个图像，但是当我使用 docker-compose 来构建图像时，它会失败并显示以下消息。可能是什么原因？

db@vagrant:~/docker$ docker-compose up --build

Building db
Step 1/3 : FROM alpine:latest
 ---> e7d92cdc71fe
Step 2/3 : WORKDIR /app
 ---> Using cache
 ---> 1491149423a1
Step 3/3 : COPY 1.txt .
ERROR: Service 'db' failed to build: failed to copy files: failed to copy file: Container ID 65536 cannot be mapped to a host ID

我的用户 ID 是由一些设置脚本生成的，导致 UID 的值大于 65535。

db@vagrant:~/docker$ id
uid=65536(db) gid=1000(db) groups=1000(db),27(sudo),998(docker)

Docker configuration for namespace mapping

db@vagrant:~/docker$ cat /etc/docker/daemon.json
{
  "userns-remap": "db"
}

db@vagrant:~/docker$ cat /etc/subuid /etc/subgid
db:100000:65536
db:100000:65536

Dockerfile 内容（1.txt 为空文件）

db@vagrant:~/docker$ cat Dockerfile
FROM alpine:latest
WORKDIR /app
COPY 1.txt .

docker-compose.yml 文件内容

db@vagrant:~/docker$ cat docker-compose.yml
version: "2"
services:
   db:
     build:
       context: .
       dockerfile: Dockerfile
     image: sirishkumar/test

docker build 命令的输出

db@vagrant:~/docker$ docker build -t sirishkumar/test .
Sending build context to Docker daemon  3.584kB
Step 1/3 : FROM alpine:latest
latest: Pulling from library/alpine
c9b1b535fdd9: Pull complete
Digest: sha256:ab00606a42621fb68f2ed6ad3c88be54397f981a7b70a79db3d1172b11c4367d
Status: Downloaded newer image for alpine:latest
 ---> e7d92cdc71fe
Step 2/3 : WORKDIR /app
 ---> Running in 55f092b96268
Removing intermediate container 55f092b96268
 ---> 8af079e6a478
Step 3/3 : COPY 1.txt .
 ---> b3c14a691102
Successfully built b3c14a691102
Successfully tagged sirishkumar/test:latest

docker-compose 的输出

db@vagrant:~/docker$ docker-compose up --build
Creating network "docker_default" with the default driver
Building db
Step 1/3 : FROM alpine:latest
latest: Pulling from library/alpine
c9b1b535fdd9: Pull complete
Digest: sha256:ab00606a42621fb68f2ed6ad3c88be54397f981a7b70a79db3d1172b11c4367d
Status: Downloaded newer image for alpine:latest
 ---> e7d92cdc71fe
Step 2/3 : WORKDIR /app
 ---> Running in fe39955aed1a
Removing intermediate container fe39955aed1a
 ---> fb23b8888f4a
Step 3/3 : COPY 1.txt .
ERROR: Service 'db' failed to build: failed to copy files: failed to copy file: Container ID 65536 cannot be mapped to a host ID

Answer 1

您有 65,536 个用户 ID 可以映射到您的 docker 用户命名空间：

db@vagrant:~/docker$ cat /etc/subuid /etc/subgid
db:100000:65536
db:100000:65536

然后您告诉 docker 将文件复制到该范围之外的 ID 拥有的容器中（用户 ID 从 0 开始）：

db@vagrant:~/docker$ id
uid=65536(db) gid=1000(db) groups=1000(db),27(sudo),998(docker)

您需要将主机上的用户ID设置在主机用户ID范围内（小于65536）。