配置TYPESENSE_SSL_CERTIFICATE_KEY后Typesense Docker容器异常退出

问题 #

尝试在生产环境中运行启用HTTPS的Typesense Docker容器，但执行Docker Compose文件后容器崩溃。移除TYPESENSE_SSL_CERTIFICATE_KEY配置项后容器能启动，但无法响应任何请求，日志中显示Typesense peering service is going to quit。

当前Docker Compose配置 #

version: "1"
services:
  typesense:
    image: typesense/typesense:0.25.2

    environment:
      - TYPESENSE_API_KEY=------------------
      - TYPESENSE_DATA_DIR=/data
      - TYPESENSE_SSL_CERTIFICATE='C:\\Certbot\\live\\xxxxxxx\\cert.pem'
      - TYPESENSE_SSL_CERTIFICATE_KEY='C:\\Certbot\\live\\xxxxxx\\privkey.pem'
      - TYPESENSE_API_PORT=443
      - TYPESENSE_ENABLE_CORS=TRUE
    ports:
      - "8108:8108"
    volumes:
      - typesense-data:/data
volumes:
  typesense-data:
    driver: local

容器崩溃日志 #

.503093   166 raft_server.cpp:501] Loading collections from disk...
.503110   166 collection_manager.cpp:187] CollectionManager::load()
.503182   166 auth_manager.cpp:34] Indexing 0 API key(s) found on disk.
.503242   166 collection_manager.cpp:207] Loading upto 16 collections in parallel, 1000 documents at a time.
.503269   166 collection_manager.cpp:216] Found 0 collection(s) on disk.
.504242   166 collection_manager.cpp:316] Loaded 0 collection(s).
.504809   166 collection_manager.cpp:320] Initializing batched indexer from snapshot state...
.504885   166 raft_server.cpp:508] Finished loading collections from disk.
.505520   166 log.cpp:690] Use murmurhash32 as the checksum type of appending entries
.505663   166 log.cpp:1172] log load_meta /data/state/log/log_meta first_log_index: 1 time: 69
.505708   166 log.cpp:1112] load open segment, path: /data/state/log first_index: 1
.506028   166 raft_meta.cpp:521] Loaded single stable meta, path /data/state/meta term 20 votedfor 172.21.0.2:8107:443 time: 19
.506099   166 node.cpp:608] node default_group:172.21.0.2:8107:443 init, term: 20 last_log_id: (index=18,term=20) conf: 172.21.0.2:8107:443 old_conf: 
.506155   166 node.cpp:1645] node default_group:172.21.0.2:8107:443 term 20 start vote and grant vote self
.510178   166 raft_meta.cpp:546] Saved single stable meta, path /data/state/meta term 21 votedfor 172.21.0.2:8107:443 time: 3321
.510275   166 node.cpp:1899] node default_group:172.21.0.2:8107:443 term 21 become leader of group 172.21.0.2:8107:443 
.510411   166 raft_server.cpp:134] Node last_index: 18
.510432   166 typesense_server_utils.cpp:283] Typesense peering service is running on 172.21.0.2:8107
.510440   166 typesense_server_utils.cpp:284] Snapshot interval configured as: 3600s
.510448   166 typesense_server_utils.cpp:285] Snapshot max byte count configured as: 4194304
.510455   166 controller.cpp:1487]** SIGINT was installed with 1**
.510462   166 typesense_server_utils.cpp:317] **Typesense peering service is going to quit.**
.510468   166 raft_server.cpp:823] Set shutting_down = true
.510473   166 raft_server.cpp:827] Waiting for in-flight writes to finish...
.510478   166 raft_server.cpp:833] Replication state shutdown, store sequence: 0
.510484   166 raft_server.cpp:837] node->shutdown
.510488   166 node.cpp:961] node default_group:172.21.0.2:8107:443 shutdown, current_term 21 state LEADER
.510533   166 node.cpp:3298] node default_group:172.21.0.2:8107:443 reset ConfigurationCtx, new_peers: 172.21.0.2:8107:443, old_peers: 172.21.0.2:8107:443
.510558   166 replicator.cpp:1499] Group default_group Fail to find the next candidate
.510573   166 raft_server.cpp:841] node->join
.510596   200 raft_server.h:273] Node stepped down : Raft node is going to quit.
.510622   200 raft_server.h:277] This node is down
.510675   166 node.cpp:961] node default_group:172.21.0.2:8107:443 shutdown, current_term 21 state SHUTDOWN
.515420   166 typesense_server_utils.cpp:322] raft_server.stop()
.515487   166 server.cpp:1167] Server[braft::RaftStatImpl+braft::FileServiceImpl+braft::RaftServiceImpl+braft::CliServiceImpl] is going to quit
.515834   166 typesense_server_utils.cpp:325] raft_server.join()
.515987   166 typesense_server_utils.cpp:328] Typesense peering service has quit.
.516564   166 typesense_server_utils.cpp:476] Shutting down batch indexer...
.516621   166 typesense_server_utils.cpp:479] Waiting for batch indexing thread to be done...
.444766   167 batched_indexer.cpp:341] Notifying batch indexer threads about shutdown...
.444990   167 batched_indexer.cpp:349] Batched indexer threadpool shutdown...
.446034   166 typesense_server_utils.cpp:482] Shutting down event sink thread...
.446125   166 typesense_server_utils.cpp:485] Waiting for event sink thread to be done...
.446331   166 typesense_server_utils.cpp:488] Waiting for housekeeping thread to be done...
.446470   166 typesense_server_utils.cpp:492] Shutting down server_thread_pool
.447083   166 typesense_server_utils.cpp:496] Shutting down app_thread_pool.
.447777   166 typesense_server_utils.cpp:500] Shutting down replication_thread_pool.
.448747     1 typesense_server_utils.cpp:518] Deleting batch indexer
.448838     1 typesense_server_utils.cpp:522] CURL clean up
.448863     1 typesense_server_utils.cpp:526] Deleting server
.449261     1 typesense_server_utils.cpp:530] CollectionManager dispose, this might take some time...
.449607     1 typesense_server_utils.cpp:534] Bye.
typesense-1 exited with code 1

解决方案 #

1. 修复证书路径与挂载问题 #

Docker容器无法直接访问宿主机的C:\Certbot\live路径，需要将证书目录挂载到容器内，同时调整环境变量中的路径为容器内路径：

• 在volumes中添加证书目录挂载：- C:\Certbot\live:/certbot/live
• 修改TYPESENSE_SSL_CERTIFICATE和TYPESENSE_SSL_CERTIFICATE_KEY为容器内路径，比如/certbot/live/xxxxxxx/cert.pem和/certbot/live/xxxxxx/privkey.pem

2. 修正端口映射与API端口配置 #

你设置了TYPESENSE_API_PORT=443，但端口映射是8108:8108，两者不匹配，需要统一：

• 如果要在容器内用443端口，端口映射改为443:443，同时添加privileged: true（443属于特权端口，需要额外权限）
• 或者改用非特权端口，比如8108，将TYPESENSE_API_PORT设为8108，保持端口映射8108:8108

3. 移除环境变量中的多余引号 #

路径值不需要加单引号，会导致容器解析路径错误，直接写路径即可。

修正后的Docker Compose示例 #

version: "3" # 建议使用较新的Compose版本
services:
  typesense:
    image: typesense/typesense:0.25.2
    environment:
      - TYPESENSE_API_KEY=------------------
      - TYPESENSE_DATA_DIR=/data
      - TYPESENSE_SSL_CERTIFICATE=/certbot/live/xxxxxxx/cert.pem
      - TYPESENSE_SSL_CERTIFICATE_KEY=/certbot/live/xxxxxx/privkey.pem
      - TYPESENSE_API_PORT=443
      - TYPESENSE_ENABLE_CORS=true
    ports:
      - "443:443"
    volumes:
      - typesense-data:/data
      - C:\Certbot\live:/certbot/live # 挂载宿主机证书目录到容器内
    privileged: true # 允许容器使用443特权端口
volumes:
  typesense-data:
    driver: local

额外排查点 #

• 检查证书文件权限：确保宿主机上的证书文件权限为644，让容器内用户能读取
• 查看完整启动日志：执行docker-compose logs -f typesense，检查是否有证书加载失败的具体报错
• 重置Raft状态：如果之前的集群状态有异常，可以删除typesense-data卷，重新初始化容器

内容的提问来源于stack exchange，提问作者ignosi