【问题标题】:Docker swarm refuses to create containers with published portsDocker swarm 拒绝创建具有已发布端口的容器
【发布时间】:2019-10-16 21:05:24
【问题描述】:

我有一个 2 个节点的 swarm(都使用 docker 19.03.1),但我遇到了麻烦 - 我经常收到

"Pool overlaps with other one on this address space" module=node/agent/taskmanager"

使用已发布端口创建服务时的消息。

群体被创造为香草:

manager@ docker swarm init
worker@ docker swarm join...

我创建了一个覆盖网络

manager@ docker network create -d overlay ids-net --attachable

在两个节点上创建一个简单的服务是可行的:

manager@ docker service create --replicas 2 --network ids-net hashicorp/http-echo -text="hello world"

结果:

image hashicorp/http-echo:latest could not be accessed on a registry to record
its digest. Each node will access hashicorp/http-echo:latest independently,
possibly leading to different nodes running different
versions of the image.

ksi39hzojsfjr4jyqck1p4rib
overall progress: 2 out of 2 tasks
1/2: running   [==================================================>]
2/2: running   [==================================================>]
verify: Service converged

发出以下导致无限循环:

manager@ docker service create --replicas 2 --publish published=5678,target=5678 --network ids-net hashicorp/http-echo -text="hello world"

显示如下:

image hashicorp/http-echo:latest could not be accessed on a registry to record
its digest. Each node will access hashicorp/http-echo:latest independently,
possibly leading to different nodes running different
versions of the image.

bjjxxomsgvsoitf55l7vuuz74
overall progress: 0 out of 2 tasks
1/2: Pool overlaps with other one on this address space
2/2: Pool overlaps with other one on this address space

系统日志显示如下:

Aug 01 15:47:03 docker dockerd[1106]: time="2019-08-01T15:47:03.283849008+02:00" level=debug msg="state changed" module=node/agent/taskmanager node.id=50coluxfs0lnx1kf07mhckito service.id=d3rxusuxfk18tuvi24l198btp state.desired=READY state.transition="ACCEPTED->PREPARING" task.id=wmu9898y2yl01ga5v40xfojmi
Aug 01 15:47:03 docker dockerd[1106]: time="2019-08-01T15:47:03.283977128+02:00" level=debug msg="(*Agent).UpdateTaskStatus" module=node/agent node.id=50coluxfs0lnx                   1kf07mhckito task.id=wmu9898y2yl01ga5v40xfojmi
Aug 01 15:47:03 docker dockerd[1106]: time="2019-08-01T15:47:03.284226242+02:00" level=debug msg="task status reported" module=node/agent node.id=50coluxfs0lnx1kf07mhckito
Aug 01 15:47:03 docker dockerd[1106]: time="2019-08-01T15:47:03.284870334+02:00" level=debug msg="(*Agent).UpdateTaskStatus" module=node/agent node.id=50coluxfs0lnx                   1kf07mhckito task.id=o036l4zcbzvnccjsp44fygnfr
Aug 01 15:47:03 docker dockerd[1106]: time="2019-08-01T15:47:03.285156543+02:00" level=debug msg="Allocating IPv4 pools for network ingress (ozjtk12iougu8fqjliqspvxx2)"
Aug 01 15:47:03 docker dockerd[1106]: time="2019-08-01T15:47:03.285200492+02:00" level=debug msg="RequestPool(LocalDefault, 10.255.0.0/16, , map[], false)"
Aug 01 15:47:03 docker dockerd[1106]: time="2019-08-01T15:47:03.285228022+02:00" level=error msg="fatal task error" error="Pool overlaps with other one on this address space" module=node/agent/taskmanager node.id=50coluxfs0lnx1kf07mhckito service.id=d3rxusuxfk18tuvi24l198btp task.id=wmu9898y2yl01ga5v40xfojmi
Aug 01 15:47:03 docker dockerd[1106]: time="2019-08-01T15:47:03.285265876+02:00" level=debug msg="state changed" module=node/agent/taskmanager node.id=50coluxfs0lnx1kf07mhckito service.id=d3rxusuxfk18tuvi24l198btp state.desired=READY state.transition="PREPARING->REJECTED" task.id=wmu9898y2yl01ga5v40xfojmi
Aug 01 15:47:03 docker dockerd[1106]: time="2019-08-01T15:47:03.285236079+02:00" level=debug msg="task status reported" module=node/agent node.id=50coluxfs0lnx1kf07mhckito
Aug 01 15:47:03 docker dockerd[1106]: time="2019-08-01T15:47:03.285726857+02:00" level=debug msg="(*Agent).UpdateTaskStatus" module=node/agent node.id=50coluxfs0lnx                   1kf07mhckito task.id=wmu9898y2yl01ga5v40xfojmi
Aug 01 15:47:03 docker dockerd[1106]: time="2019-08-01T15:47:03.286082096+02:00" level=debug msg="task status reported" module=node/agent node.id=50coluxfs0lnx1kf07mhckito
Aug 01 15:47:03 docker dockerd[1106]: time="2019-08-01T15:47:03.286697616+02:00" level=debug msg="(*Agent).UpdateTaskStatus" module=node/agent node.id=50coluxfs0lnx                   1kf07mhckito task.id=wmu9898y2yl01ga5v40xfojmi
Aug 01 15:47:03 docker dockerd[1106]: time="2019-08-01T15:47:03.287043607+02:00" level=debug msg="task status reported" module=node/agent node.id=50coluxfs0lnx1kf07mhckito
Aug 01 15:47:03 docker dockerd[1106]: time="2019-08-01T15:47:03.316386815+02:00" level=debug msg="state for task wmu9898y2yl01ga5v40xfojmi updated to REJECTED" method="(*Dispatcher).processUpdates" module=dispatcher node.id=50coluxfs0lnx1kf07mhckito state.transition="ASSIGNED->REJECTED" task.id=wmu9898y2yl01ga5v40xfojmi

我认为覆盖网络存在问题。 经理收益率上的manager@ docker inspect <network id>

    {
        "Name": "ids-net",
        "Id": "jzvu45w1b247whq6qsx3v7fdy",
        "Created": "2019-07-31T10:10:38.436102588+02:00",
        "Scope": "swarm",
        "Driver": "overlay",
        "EnableIPv6": false,
        "IPAM": {
            "Driver": "default",
            "Options": null,
            "Config": [
                {
                    "Subnet": "10.0.1.0/24",
                    "Gateway": "10.0.1.1"
                }
            ]
        },
        "Internal": false,
        "Attachable": true,
        "Ingress": false,
        "ConfigFrom": {
            "Network": ""
        },
        "ConfigOnly": false,
        "Containers": {
            ...
        },
        "Options": {
            "com.docker.network.driver.overlay.vxlanid_list": "4098"
        },
        "Labels": {},
        "Peers": [
            {
                "Name": "22a3eb7a8eec",
                "IP": "192.168.100.92"
            }
        ]
    }
]

在工作节点上,未创建网络。 (对吗?)

这是两台机器根据@BMitch 的要求输出的ip r

manager@ ip r
default via 192.168.100.11 dev ens192 onlink
10.255.0.0/24 dev docker0 proto kernel scope link src 10.255.0.1
10.255.1.0/24 dev br-686969a42803 proto kernel scope link src 10.255.1.1
10.255.23.0/24 dev docker_gwbridge proto kernel scope link src 10.255.23.1
10.255.42.0/24 dev br-c03d759e1553 proto kernel scope link src 10.255.42.1
192.168.100.0/24 dev ens192 proto kernel scope link src 192.168.100.92
worker@ ip r
default via 192.168.100.11 dev eth0 onlink
10.254.0.0/24 dev docker0 proto kernel scope link src 10.254.0.1
10.255.3.0/24 dev docker_gwbridge proto kernel scope link src 10.255.3.1
10.255.4.0/24 dev br-88f241f38441 proto kernel scope link src 10.255.4.1
192.168.100.0/24 dev eth0 proto kernel scope link src 192.168.100.106

这是来自manager/etc/docker/daemon.json

manager@ cat /etc/docker/daemon.json
{
  "registry-mirrors": ["https://repo.ids.net"],
  "default-address-pools": [
    {"base":"10.255.255.0/16","size":24}
  ]
}

worker 看起来不同:

manager@ cat /etc/docker/daemon.json
{
  "registry-mirrors": ["https://repo.ids.net"],
  "default-address-pools": [
    {"base":"10.254.255.0/16","size":24}
  ]
}

这是入口网络配置:

root@docker:/etc/nginx/conf.d# docker network inspect ozjtk12iougu
[
    {
        "Name": "ingress",
        "Id": "ozjtk12iougu8fqjliqspvxx2",
        "Created": "2019-07-31T07:36:57.368162913Z",
        "Scope": "swarm",
        "Driver": "overlay",
        "EnableIPv6": false,
        "IPAM": {
            "Driver": "default",
            "Options": null,
            "Config": [
                {
                    "Subnet": "10.255.0.0/16",
                    "Gateway": "10.255.0.1"
                }
            ]
        },
        "Internal": false,
        "Attachable": false,
        "Ingress": true,
        "ConfigFrom": {
            "Network": ""
        },
        "ConfigOnly": false,
        "Containers": null,
        "Options": {
            "com.docker.network.driver.overlay.vxlanid_list": "4096"
        },
        "Labels": null
    }
]

我已多次清除两个系统,并从头开始重新启动两个服务器。

有人可以指导我吗?

谢谢 M

【问题讨论】:

  • 请在您的问题中包含ip r 的输出。
  • @BMitch - 这样做了
  • @BMitch - 感谢您的帮助 - 我添加了 daemon.json 文件

标签: docker docker-swarm docker-networking


【解决方案1】:

使用发布的端口,docker 正在尝试配置入口网络:

Aug 01 15:47:03 docker dockerd[1106]: time="2019-08-01T15:47:03.285156543+02:00" level=debug msg="Allocating IPv4 pools for network ingress (ozjtk12iougu8fqjliqspvxx2)"
Aug 01 15:47:03 docker dockerd[1106]: time="2019-08-01T15:47:03.285200492+02:00" level=debug msg="RequestPool(LocalDefault, 10.255.0.0/16, , map[], false)"

这似乎是入口子网的整个 /16,并与 docker 已在该 /16 块中分配的其他子网重叠:

10.255.0.0/24 dev docker0 proto kernel scope link src 10.255.0.1
10.255.1.0/24 dev br-686969a42803 proto kernel scope link src 10.255.1.1
10.255.23.0/24 dev docker_gwbridge proto kernel scope link src 10.255.23.1
10.255.42.0/24 dev br-c03d759e1553 proto kernel scope link src 10.255.42.1

最好的猜测是您以不兼容的方式配置了网络和默认地址池。这可能是通过手动创建ingress 网络来完成的,并且/etc/docker/daemon.json 文件中的设置也可能导致这些冲突。


编辑:从您的更新来看,这个猜测似乎是正确的。您已将 docker 的三个不同部分配置为使用相同的地址空间,这将导致冲突。其中一个部分,入口网络,正在为自己使用整个地址空间。您应该配置桥接网络(使用 daemon.json 中的默认地址池)、覆盖网络(使用 docker swarm init 期间的地址池选项,您几乎肯定会通过)和入口网络(您可能手动创建),每个都有一个单独的非重叠 CIDR 块。

【讨论】:

  • 好的 - 感谢您的出色解释 - 我的网络技能真的很糟糕。我会努力解决这个问题。我将移除 swarm 并编辑 daemon.json 并重新创建 swarm。不知道,如何重新创建 docker0-interface 和 docker_gwbridge。希望这会在重新启动服务时自动发生...?
  • 显然,我太笨了,无法解决这个问题 - 我看不到,我必须更改哪一个(桥接、覆盖或入口)。如果有人愿意指导我,我将不胜感激..?
猜你喜欢
  • 1970-01-01
  • 2018-05-09
  • 2019-09-06
  • 1970-01-01
  • 2016-05-11
  • 2016-11-03
  • 1970-01-01
  • 1970-01-01
  • 2014-09-26
相关资源
最近更新 更多