Apple Silicon升级Sonoma14.3后Docker中DB2启动报错求助

Apple Silicon Mac升级至Sonoma 14.3后，原正常运行的x86_64架构DB2 Docker容器启动失败，报错：

db2start: error while loading shared libraries: libicudatadb2.so.32: cannot enable executable stack as shared object requires: Invalid argument

完整启动日志：

DB2 State : Operable
DB2 has not been started
Starting DB2...

ssh-keygen: generating new host keys: RSA DSA ECDSA ED25519 
(*) All databases are now active. 
(*) Setup has completed.
HOSTNAME: 54f62d87e0cf
FUNCTION: DB2 UDB, config/install, sqlfLogUpdateCfgParam, probe:30
CHANGE  : CFG DBM: "Dftdbpath" From: ""  To: "/database/data" 

2024-01-24-06.05.46.957009+000 I5190E318             LEVEL: Event
PID     : 70332                TID : 140737382190592 PROC : db2flacc
INSTANCE: db2inst1             NODE : 000
HOSTNAME: 54f62d87e0cf
FUNCTION: DB2 UDB, config/install, sqlfLogUpdateCfgParam, probe:30
CHANGE  : CFG DBM: "Federated" From: "0"  To: "1" 
(*) Ending DB2 with db2stop force and db2ts "stop for text"
db2stop: error while loading shared libraries: libicudatadb2.so.32: cannot enable executable stack as shared object requires: Invalid argument
(*) Done

容器启动命令：

docker run --rm -ti --platform linux/amd64 -itd --name db2 --privileged=true -p 50000:50000 -e LICENSE=accept -e DB2INST1_PASSWORD=root -v db2-volume:/database ibmcom/db2 uname -m x86_64

1. 关闭容器seccomp限制 #

Sonoma 14.3对Rosetta 2的可执行栈策略收紧，添加--security-opt seccomp=unconfined参数允许容器使用可执行栈：

docker run --rm -ti --platform linux/amd64 -itd --name db2 --privileged=true --security-opt seccomp=unconfined -p 50000:50000 -e LICENSE=accept -e DB2INST1_PASSWORD=root -v db2-volume:/database ibmcom/db2 uname -m x86_64

2. 修改库文件的可执行栈属性 #

若不想全局关闭seccomp，可单独调整问题库的栈标记：

• 启动容器进入bash：

  docker run --rm -ti --platform linux/amd64 --privileged=true -p 50000:50000 -e LICENSE=accept -e DB2INST1_PASSWORD=root -v db2-volume:/database ibmcom/db2 bash
  

• 清除库的可执行栈标记：

  execstack -c /opt/ibm/db2/V11.1/lib64/libicudatadb2.so.32
  

• 手动启动DB2：

  su - db2inst1 -c "db2start"
  

• 可选：基于修改后的容器构建新镜像，避免重复操作。

3. 升级DB2镜像版本 #

旧版DB2镜像可能存在兼容性问题，尝试使用更新的镜像标签（如11.5.9.0）：

docker run --rm -ti --platform linux/amd64 -itd --name db2 --privileged=true -p 50000:50000 -e LICENSE=accept -e DB2INST1_PASSWORD=root -v db2-volume:/database ibmcom/db2:11.5.9.0 uname -m x86_64

内容的提问来源于stack exchange，提问作者aldien