群晖DS923+升级DSM后Docker运行node-exporter挂载报错求助

错误现象 #

升级DSM 7.2-64570 Update 1后，node-exporter容器无法启动，手动执行启动命令时返回错误：

Error response from daemon: path /proc is mounted on /proc but it is not a shared or slave mount

简化为直接用docker run命令测试，仍报错：

$ sudo docker run --net="host" --pid="host" -v "/:/host:ro,rslave" prom/node-exporter:v1.5.0 --path.rootfs=/host
docker: Error response from daemon: path / is mounted on / but it is not a shared or slave mount.

环境信息 #

Docker版本 #

$ sudo docker version
Client:
 Version:           20.10.23
 API version:       1.41
 Go version:        go1.19.1
 Git commit:        876964a
 Built:             Wed Jun 14 06:00:26 2023
 OS/Arch:           linux/amd64
 Context:           default
 Experimental:      true

Server:
 Engine:
  Version:          20.10.23
  API version:      1.41 (minimum version 1.12)
  Go version:       go1.19.1
  Git commit:       5fcb1cf
  Built:            Wed Jun 14 06:00:58 2023
  OS/Arch:          linux/amd64
  Experimental:     false
 containerd:
  Version:          v1.6.15
  GitCommit:        b23a389d8c181697302d163356e97dec04eb8d88
 runc:
  Version:          v1.1.4
  GitCommit:        5af893d
 docker-init:
  Version:          0.19.0
  GitCommit:        ed96d00

Docker Compose版本 #

$ docker-compose version
Docker Compose version v2.9.0-6413-g38f6acd

系统挂载表 #

$ sudo mount
/dev/md0 on / type ext4 (rw,noatime,data=ordered)
sysfs on /sys type sysfs (rw,nosuid,nodev,noexec,relatime)
proc on /proc type proc (rw,nosuid,nodev,noexec,relatime)
devtmpfs on /dev type devtmpfs (rw,nosuid,size=1988388k,nr_inodes=497097,mode=755)
securityfs on /sys/kernel/security type securityfs (rw,nosuid,nodev,noexec,relatime)
tmpfs on /dev/shm type tmpfs (rw,nosuid,nodev)
devpts on /dev/pts type devpts (rw,nosuid,noexec,relatime,gid=5,mode=620,ptmxmode=000)
tmpfs on /run type tmpfs (rw,nodev,mode=755)
tmpfs on /sys/fs/cgroup type tmpfs (ro,nosuid,nodev,noexec,mode=755)
cgroup on /sys/fs/cgroup/systemd type cgroup (rw,nosuid,nodev,noexec,relatime,xattr,release_agent=/usr/lib/systemd/systemd-cgroups-agent,name=systemd)
cgroup on /sys/fs/cgroup/synomonitor type cgroup (rw,nosuid,nodev,noexec,relatime,name=synomonitor)
cgroup on /sys/fs/cgroup/cpuacct type cgroup (rw,nosuid,nodev,noexec,relatime,cpuacct)
cgroup on /sys/fs/cgroup/memory type cgroup (rw,nosuid,nodev,noexec,relatime,memory)
cgroup on /sys/fs/cgroup/cpu type cgroup (rw,nosuid,nodev,noexec,relatime,cpu)
cgroup on /sys/fs/cgroup/freezer type cgroup (rw,nosuid,nodev,noexec,relatime,freezer)
cgroup on /sys/fs/cgroup/blkio type cgroup (rw,nosuid,nodev,noexec,relatime,blkio)
cgroup on /sys/fs/cgroup/cpuset type cgroup (rw,nosuid,nodev,noexec,relatime,cpuset)
cgroup on /sys/fs/cgroup/devices type cgroup (rw,nosuid,nodev,noexec,relatime,devices)
tmpfs on /tmp type tmpfs (rw,nosuid,nodev,noexec)
debugfs on /sys/kernel/debug type debugfs (rw,nosuid,nodev,noexec,relatime)
devtmpfs on /proc/bus/usb type devtmpfs (rw,nosuid,size=1988388k,nr_inodes=497097,mode=755)
configfs on /sys/kernel/config type configfs (rw,nosuid,nodev,noexec,relatime)
/dev/mapper/cachedev_0 on /volume1 type btrfs (rw,nodev,relatime,ssd,synoacl,space_cache=v2,auto_reclaim_space,metadata_ratio=50,block_group_cache_tree,syno_allocator,subvolid=256,subvol=/@syno)
none on /config type configfs (rw,nosuid,nodev,noexec,relatime)
fusectl on /sys/fs/fuse/connections type fusectl (rw,nosuid,nodev,noexec,relatime)
/dev/mapper/cachedev_0 on /volume1/@docker type btrfs (rw,nodev,relatime,ssd,synoacl,space_cache=v2,auto_reclaim_space,metadata_ratio=50,block_group_cache_tree,syno_allocator,subvolid=256,subvol=/@syno)
/dev/mapper/cachedev_0 on /volume1/@docker/btrfs type btrfs (rw,nodev,relatime,ssd,synoacl,space_cache=v2,auto_reclaim_space,metadata_ratio=50,block_group_cache_tree,syno_allocator,subvolid=256,subvol=/@syno)
nsfs on /run/docker/netns/default type nsfs (rw)

解决方案 #

方法1：临时修改挂载属性（重启后失效） #

执行以下命令修改根目录和/proc的挂载属性为slave：

sudo mount --make-slave /
sudo mount --make-slave /proc

之后再执行node-exporter的启动命令即可。

方法2：调整挂载路径，避免挂载整个根目录 #

不需要挂载整个根目录，只挂载node-exporter需要的关键路径，命令如下：

sudo docker run \
  --net="host" \
  --pid="host" \
  -v "/proc:/host/proc:ro" \
  -v "/sys:/host/sys:ro" \
  -v "/:/host/rootfs:ro,rslave" \
  prom/node-exporter:v1.5.0 \
  --path.procfs=/host/proc \
  --path.sysfs=/host/sys \
  --path.rootfs=/host/rootfs \
  --collector.filesystem.ignored-mount-points="^/(sys|proc|dev|host|etc)($|/)"

方法3：持久化挂载属性（重启后生效） #

群晖重启后挂载属性会恢复默认，可通过开机脚本持久化修改：

1. 创建脚本文件 /usr/local/bin/fix-mounts.sh，内容：

#!/bin/sh
mount --make-slave /
mount --make-slave /proc

2. 赋予执行权限：

sudo chmod +x /usr/local/bin/fix-mounts.sh

3. 编辑 /etc/rc.local（不存在则新建），在exit 0前添加：

/usr/local/bin/fix-mounts.sh

内容的提问来源于stack exchange，提问作者Lily Mara