我正在使用docker-compose作为sentry on-premise安装的一部分。
下面是我的docker-compose. yml的nginx部分的片段。这是提供给我的nginx容器配置。你会注意到它有一个现有的卷挂载。
nginx:
<< : *restart_policy
ports:
- '$SENTRY_BIND:80/tcp'
image: 'nginx'
volumes:
- type: bind
read_only: true
source: ./nginx
target: /etc/nginx
depends_on:
- web
- relay
问题是,我需要额外的挂载,以便我的nginx配置正常工作。我需要能够挂载SSL证书。当我对nginx部分进行以下修改时...
nginx:
<< : *restart_policy
ports:
- '$SENTRY_BIND:80/tcp'
image: 'nginx'
volumes:
- type: bind
read_only: true
source: ./nginx
target: /etc/nginx
- type: bind
read_only: true
source: ./certs
target: /etc/nginx/certs
depends_on:
- web
- relay
relay:
...我在使用docker-compose up -d时得到以下错误:
Creating sentry_onpremise_nginx_1 ... error
Creating sentry_onpremise_ingest-consumer_1 ... done
Creating sentry_onpremise_subscription-consumer-events_1 ... done
me/brad/repo/onpremise/certs" to rootfs at "/var/lib/docker/overlay2/357f60b96e866d8dd84d657f7cad55fad76420a61cc8cb35a10ebcb13bcf4060/merged/etc/nginx/certs" caused: mkdir /var/lib/docker/overlay2/357f60b96e866d8dd84d657f7cad55fad76420a61cc8cb35a10ebcb13bcf4060/merged/etc/nginx/certs: read-only file system: unknown
ERROR: for nginx Cannot start service nginx: OCI runtime create failed: container_linux.go:367: starting container process caused: process_linux.go:495: container init caused: rootfs_linux.go:60: mounting "/home/brad/repo/onpremise/certs" to rootfs at "/var/lib/docker/overlay2/357f60b96e866d8dd84d657f7cad55fad76420a61cc8cb35a10ebcb13bcf4060/merged/etc/nginx/certs" caused: mkdir /var/lib/docker/overlay2/357f60b96e866d8dd84d657f7cad55fad76420a61cc8cb35a10ebcb13bcf4060/merged/etc/nginx/certs: read-only file system: unknown
ERROR: Encountered errors while bringing up the project.
任何帮助都将不胜感激。我对docker/compose不是很有经验。
编辑:值得一提的是,当我运行docker exec -it sentry_onpremise_nginx_1 /bin/bash
并试图在容器内创建一个目录时,我会遇到类似的错误:
root@83afd0c563de:/etc/nginx# mkdir certs
mkdir: cannot create directory 'certs': Read-only file system
2条答案
按热度按时间6tdlim6h1#
通过将certs目录放置在nginx目录下解决了这个问题。挂载彼此冲突。首先使用RO挂载到/etc/nginx,然后阻止挂载到/etc/nginx/certs,因为它试图附加到只读部分。
50few1ms2#
您可以使用**--privileged**参数创建/运行您的容器。
就像这样:
这当然不是最好的解决方案。