Azure容器应用中Docker部署Umbraco的登录会话异常问题

问题描述 #

• 基于Docker镜像的Umbraco 12部署在Azure Container Apps后，出现间歇性后台登录会话丢失：用户登录后立即被重定向回登录页，无任何错误提示。
• 问题触发时，运行应用的容器会自动销毁重启，但日志未记录重启原因；等待约1小时或重新创建应用可临时恢复，但问题会随机复发。
• 已尝试多种卷配置：挂载Azure Files到umbraco/data和umbraco/logs、不使用共享卷、使用内部卷等，问题均未解决。
• 进一步排查发现问题与Azure Container Apps共享卷挂载权限相关，日志中出现以下错误：

{"@t":"2023-10-22T10:11:51.5036377Z","@mt":"Error trying to release DB","@l":"Error","@x":"System.UnauthorizedAccessException: Access to the path '/app/umbraco/Data/TEMP/NuCache/NuCache.Media.db' is denied.\n ---> System.IO.IOException: Permission denied\n   --- End of inner exception stack trace ---\n   at System.IO.RandomAccess.WriteAtOffset(SafeFileHandle handle, ReadOnlySpan`1 buffer, Int64 fileOffset)\n   at System.IO.Strategies.OSFileStreamStrategy.Write(ReadOnlySpan`1 buffer)\n   at System.IO.Strategies.BufferedFileStreamStrategy.WriteSpan(ReadOnlySpan`1 source, ArraySegment`1 arraySegment)\n   at CSharpTest.Net.IO.TransactedCompoundFile.fput(Int64 position, Byte[] bytes, Int32 offset, Int32 length)\n   at CSharpTest.Net.IO.TransactedCompoundFile.FileSection.Write(BlockRef block, FPut fput, Byte[] bytes, Int32 offset, Int32 length)\n   at CSharpTest.Net.IO.TransactedCompoundFile.Write(UInt32 handle, Byte[] bytes, Int32 offset, Int32 length)\n   at CSharpTest.Net.Storage.BTreeFileStoreV2.Update[T](IStorageHandle handleIn, ISerializer`1 serializer, T node)\n   at CSharpTest.Net.Collections.BPlusTree`2.StorageCache.OnItemRemoved(KeyValuePair`2 item)\n   at CSharpTest.Net.Collections.LurchTable`2.TryDequeue(Predicate`1 predicate, KeyValuePair`2& value)\n   at CSharpTest.Net.Collections.LurchTable`2.TryDequeue(KeyValuePair`2& value)\n   at CSharpTest.Net.Collections.BPlusTree`2.StorageCache.Flush()\n   at CSharpTest.Net.Collections.BPlusTree`2.StorageCache.Commit()\n   at CSharpTest.Net.Collections.BPlusTree`2.CommitChanges(Boolean requiresLock)\n   at CSharpTest.Net.Collections.BPlusTree`2.Dispose()\n   at Umbraco.Cms.Infrastructure.PublishedCache.ContentStore.ReleaseLocalDb()","SourceContext":"ContentStore","ProcessId":1,"ProcessName":"dotnet","ThreadId":25,"ApplicationId":"d2b6c12ab2d22552b3a7faee0509e6139f633afc","MachineName":"peach-cms--lt6pksz-dd5b6f5cc-kltdw","Log4NetLevel":"ERROR"}

权限问题解决建议 #

1. 调整Docker镜像内用户权限 #

• 在Dockerfile中添加指令，确保运行应用的用户对/app/umbraco/Data和/app/umbraco/Logs目录拥有读写权限：

# 创建非root用户并设置目录权限
RUN useradd -m appuser
RUN chown -R appuser:appuser /app/umbraco/Data /app/umbraco/Logs
USER appuser

• 若使用Umbraco官方镜像，确认镜像默认用户的UID/GID，必要时调整目录权限匹配该用户。

2. 配置Azure Files卷挂载权限 #

• 确保Azure存储账户的文件共享权限设置为ReadWrite，并为Container Apps的服务主体分配Storage File Data SMB Share Contributor角色权限。
• 挂载卷时指定uid和gid参数，匹配Docker容器内运行用户的ID（以YAML配置为例）：

volumes:
  - name: umbraco-data
    storageName: your-storage-account-name
    storageType: AzureFiles
    shareName: umbraco-data-share
    mountPath: /app/umbraco/Data
    readOnly: false
    volumeMountOptions: "uid=1000,gid=1000" # 替换为容器内用户实际的UID/GID

3. 切换至分布式存储替代本地文件缓存 #

• 配置Azure Redis Cache作为Umbraco的分布式缓存，避免依赖本地文件系统存储会话和NuCache数据：
  在appsettings.json中添加配置：

"Umbraco": {
  "CMS": {
    "Global": {
      "DistributedCache": {
        "Enabled": true,
        "Redis": {
          "ConnectionString": "your-redis-connection-string"
        }
      }
    },
    "PublishedCache": {
      "NuCache": {
        "UseDistributedCache": true
      }
    }
  }
}

• 配置ASP.NET Core会话使用分布式缓存：
  在Program.cs中添加：

builder.Services.AddSession(options =>
{
    options.IdleTimeout = TimeSpan.FromHours(2);
    options.Cookie.HttpOnly = true;
    options.Cookie.IsEssential = true;
});
builder.Services.AddStackExchangeRedisCache(options =>
{
    options.Configuration = "your-redis-connection-string";
});

4. 排查容器重启根源 #

• 启用Azure Container Apps的容器洞察功能，查看容器重启的详细指标（如内存/CPU占用、OOM kill事件），排除资源不足导致的重启。
• 检查Umbraco应用的完整日志，确认是否存在未捕获的异常导致进程崩溃。

内容的提问来源于stack exchange，提问作者Crwydryn