树莓派Docker部署arm64v8/mongo时证书访问被拒问题求助

在树莓派上使用arm64v8/mongo镜像运行Docker容器时，配置TLS证书后容器启动即因权限拒绝崩溃，已排除以下情况：

• Raspbian OS不使用SELinux，无需考虑相关限制
• 主机上证书所在目录无读取保护
• 设置privileged: true无法解决问题

docker-compose.yml配置：

services:
  mongodb:
    image: arm64v8/mongo
    container_name: mongodb
    command: --tlsMode requireTLS --tlsCertificateKeyFile /etc/ssl/mongo/mongodb.pem --tlsCAFile /etc/ssl/mongo/ca.pem
    privileged: true
    ports:
      - "27017:27017"
    volumes:
      - /etc/ssl/mongo:/etc/ssl/mongo
      - mongodb_data:/data/db

崩溃错误日志：

{"t":{"$date":"2025-04-09T23:10:28.348+00:00"},"s":"I",  "c":"CONTROL",  "id":23285,   "ctx":"main","msg":"Automatically disabling TLS 1.0, to force-enable TLS 1.0 specify --sslDisabledProtocols 'none'"}
{"t":{"$date":"2025-04-09T23:10:28.349+00:00"},"s":"E",  "c":"NETWORK",  "id":23248,   "ctx":"main","msg":"Cannot read certificate file","attr":{"keyFile":"/etc/ssl/mongo/mongodb.pem","error":"error:FFFFFFFF8000000D:system library::Permission denied"}}
{"t":{"$date":"2025-04-09T23:10:28.349+00:00"},"s":"F",  "c":"CONTROL",  "id":20574,   "ctx":"main","msg":"Error during global initialization","attr":{"error":{"code":140,"codeName":"InvalidSSLConfiguration","errmsg":"Can not set up PEM key file."}}}

问题根源是arm64v8/mongo镜像默认以mongodb用户（UID/GID通常为999）运行容器，而挂载的证书文件权限未对该用户开放。以下是两种可行解决方法：

方法1：调整主机证书文件权限 #

在树莓派主机上执行命令，修改证书文件及目录的权限，让mongodb用户能读取：

# 给证书目录添加其他用户读取+执行权限
chmod o+rx /etc/ssl/mongo
# 给证书文件添加其他用户读取权限
chmod o+r /etc/ssl/mongo/*.pem

或者更精准地设置UID为999的用户权限：

# 更改文件所属组为999（mongodb用户的GID）
chgrp 999 /etc/ssl/mongo/*.pem
# 给组添加读取权限
chmod g+r /etc/ssl/mongo/*.pem

方法2：在docker-compose中指定以root用户运行 #

修改docker-compose.yml，添加user: root配置，让容器以root用户启动，从而拥有证书文件的读取权限：

services:
  mongodb:
    image: arm64v8/mongo
    container_name: mongodb
    command: --tlsMode requireTLS --tlsCertificateKeyFile /etc/ssl/mongo/mongodb.pem --tlsCAFile /etc/ssl/mongo/ca.pem
    user: root  # 添加这一行
    ports:
      - "27017:27017"
    volumes:
      - /etc/ssl/mongo:/etc/ssl/mongo
      - mongodb_data:/data/db

注意：以root运行容器会降低安全性，建议优先使用方法1。

内容的提问来源于stack exchange，提问作者DeveloLongScript