基于AMI创建的EC2中Docker容器因日志目录缺失重启求助

原EC2实例上的应用运行正常，但因私钥丢失无法维护，于是基于原实例创建AMI并启动新EC2实例，认为是完全复制且能正常访问。新实例部署了HAProxy和6个Docker容器，但其中nowce-infrastructure_service_1容器因权限相关问题持续重启——原实例中该容器运行正常，按道理权限应该一致。

docker-compose配置文件 #

version: "2"
services:
  #haproxy:
  #  image: haproxy:1.8-alpine
  #  volumes:
  #   - ./app/resources/haproxy/haproxy-container.new.cfg:/usr/local/etc/haproxy/haproxy-container.new.cfg
  #   - ./app/resources/haproxy/haproxy.cfg:/usr/local/etc/haproxy/haproxy.cfg
  #  ports:
  #   - 8082:8082
  mysql:
    image: mysql:5.7
    restart: always
    volumes:
     - ./test/fixtures/infrastructure_structure.sql:/docker-entrypoint-initdb.d/dump.sql
     - ./data/mysql:/var/lib/mysql
    ports:
     - 3308:3306
    environment:
     - MYSQL_ROOT_PASSWORD=xxxxxxxxxx
     - MYSQL_DATABASE=xxxxxxxxxx
  service:
    image: node:6.14.4-alpine
    restart: always
    working_dir: /home/node
    entrypoint: "node ./app/app.js"
    mem_limit: "300M"
    memswap_limit: "1G"
    ports:
     - "${APP_PORT}:13003"
    volumes:
     - .:/home/node
     - ./logs:/home/node/logs
    user: node
    depends_on:
     - mysql
    # - haproxy
    links:
     - mysql
    environment:
     - NODE_ENV=production
     - SERVICE_ROUTE=infrastructure
     - DEBUG=*
networks:
  default:
    external:
      name: nowce-temp-network

运行中的容器列表 #

CONTAINER ID        IMAGE                 COMMAND                  CREATED             STATUS                       PORTS                                NAMES
9e405ef44a3c        node:6.14.4-alpine    "node ./app/app.js"      17 hours ago        Restarting (1) 3 hours ago   0.0.0.0:13003->13003/tcp             nowce-infrastructure_service_1
4bc7dd4a153b        mysql:5.7             "docker-entrypoint.sh"   20 hours ago        Up 20 hours                  33060/tcp, 0.0.0.0:3308->3306/tcp    nowce-infrastructure_mysql_1
e539326f97ba        node:16.19-alpine     "node ./app/app.js --"   34 hours ago        Up 23 hours                  0.0.0.0:20000->13001/tcp             nowce-service_service_1
d873909f7800        redis:4.0.11-alpine   "docker-entrypoint.sh"   34 hours ago        Up 23 hours                  6379/tcp, 0.0.0.0:20001->26379/tcp   nowce-service_redisdb_1
1da9e22fabd8        node:6.14.4-alpine    "node ./app/app.js"      4 years ago         Up 23 hours                  0.0.0.0:13002->13002/tcp             nowce-accounts_service_1
c07153370d75        mysql:5.7             "docker-entrypoint.sh"   4 years ago         Up 23 hours                  33060/tcp, 0.0.0.0:3307->3306/tcp    nowce-accounts_mysql_1

容器报错日志 #

Sun, 15 Oct 2023 07:32:07 GMT express:router:layer new '/infrastructure/ism/webhook'
Sun, 15 Oct 2023 07:32:07 GMT express:router:route post '/infrastructure/ism/webhook'
Sun, 15 Oct 2023 07:32:07 GMT express:router:layer new '/'
listening on port:  13003
**** App started ****
2023-10-15T07:32:07.203Z
events.js:160
      throw er; // Unhandled 'error' event
      ^

Error: ENOENT: no such file or directory, open '/home/node/logs/accounts-service-2023-10-15.log'
    at Error (native)

报错显示无法打开/home/node/logs/accounts-service-2023-10-15.log，实际/home/node/logs/目录不存在，但/home/node/存在。已执行sudo chmod 777 /home/node/logs修改权限，但问题依旧，本地开发环境启动无此问题，需检查哪些内容？

• 检查宿主机./logs目录状态：docker-compose里挂载了./logs:/home/node/logs，如果宿主机当前目录下没有logs文件夹，Docker会自动创建一个文件而非目录，这会导致容器内无法写入日志。先确认宿主机对应路径下的logs是目录还是文件，若是文件则删除后重新创建目录：

  rm -f ./logs
  mkdir logs
  

• 核对宿主机logs目录的权限归属：容器以node用户运行，需要宿主机logs目录的权限允许node写入。先通过docker exec nowce-infrastructure_service_1 id node获取容器内node用户的UID/GID，再修改宿主机目录权限：

  # 假设获取到的UID是1000，GID是1000
  chown 1000:1000 ./logs
  

• 检查应用代码的日志路径配置：报错中的日志文件名是accounts-service-xxxx.log，但当前容器是infrastructure服务，可能代码里的日志路径或文件名配置有误，误引用了其他服务的配置。
• 验证容器内挂载目录的实际状态：进入容器查看/home/node/logs的存在性和写入权限：

  docker exec -it nowce-infrastructure_service_1 sh
  ls -ld /home/node/logs
  touch /home/node/logs/test.log
  

• 确认AMI的目录完整性：虽然认为AMI是原实例的完全复制，但可能原实例的logs目录是AMI创建后才生成的，导致新实例宿主机缺少该目录。

内容的提问来源于stack exchange，提问作者Darren