MacBook M1上Docker部署MongoDB集群无法获取安全密钥求助

在MacBook M1上通过以下docker-compose.yml部署MongoDB副本集集群：

version: "3.5"

services:
  mongodb1:
    image: mongo
    container_name: auths_mongodb1
    restart: always
    healthcheck:
      test: echo 'db.runCommand("ping").ok; exit()' | mongosh --host localhost:27017 -u root -p root --quiet
      interval: 5s
      timeout: 5s
      retries: 5
      start_period: 30s
    ulimits:
      nofile:
        soft: 65536
        hard: 65536
    expose:
      - 27017
    ports:
      - "10100:27017"
    command: mongod --replSet rs0 --config /etc/mongod.conf
    volumes:
      - ./docker/mongodb/r1/data/db:/data/db
      - ./docker/mongodb/r1/data/configdb:/data/configdb
      - ./docker/mongodb/r1/keys:/keys
      - ./docker/mongodb/r1/mongod.conf:/etc/mongod.conf
    environment:
      MONGO_INITDB_ROOT_USERNAME: root
      MONGO_INITDB_ROOT_PASSWORD: root

  mongodb2:
    image: mongo
    container_name: auths_mongodb2
    restart: always
    healthcheck:
      test: echo 'db.runCommand("ping").ok; exit()' | mongosh --host localhost:27017 -u root -p root --quiet
      interval: 5s
      timeout: 5s
      retries: 5
      start_period: 30s
    ulimits:
      nofile:
        soft: 65536
        hard: 65536
    ports:
      - "10101:27017"
    command: mongod --replSet rs0 --config /etc/mongod.conf
    volumes:
      - ./docker/mongodb/r2/data/db:/data/db
      - ./docker/mongodb/r2/data/configdb:/data/configdb
      - ./docker/mongodb/r2/keys:/keys
      - ./docker/mongodb/r2/mongod.conf:/etc/mongod.conf
    environment:
      MONGO_INITDB_ROOT_USERNAME: root
      MONGO_INITDB_ROOT_PASSWORD: root

  mongodb3:
    image: mongo
    container_name: auths_mongodb3
    restart: always
    healthcheck:
      test: echo 'db.runCommand("ping").ok; exit()' | mongosh --host localhost:27017 -u root -p root --quiet
      interval: 5s
      timeout: 5s
      retries: 5
      start_period: 30s
    ulimits:
      nofile:
        soft: 65536
        hard: 65536
    ports:
      - "10102:27017"
    command: mongod --replSet rs0 --config /etc/mongod.conf
    volumes:
      - ./docker/mongodb/r3/data/db:/data/db
      - ./docker/mongodb/r3/data/configdb:/data/configdb
      - ./docker/mongodb/r3/keys:/keys
      - ./docker/mongodb/r3/mongod.conf:/etc/mongod.conf
    environment:
      MONGO_INITDB_ROOT_USERNAME: root
      MONGO_INITDB_ROOT_PASSWORD: root

 # this container will exit after executing the command
  mongodb:
    image: mongo:5.0
    container_name: auths_mongodb
    restart: 'no'
    command: >
      mongosh --host auths_mongodb1:27017 -u root -p root --eval
      '
      config = {
      "_id" : "rs0",
      "members" : [
        {
          "_id" : 0,
          "host" : "auths_mongodb1:27017"
        },
        {
          "_id" : 1,
          "host" : "auths_mongodb2:27017"
        },
        {
          "_id" : 2,
          "host" : "auths_mongodb3:27017"
        }
      ]
      };
      rs.initiate(config);
      '
    depends_on:
      - mongodb1
      - mongodb2
      - mongodb3

通过以下命令生成KeyFile：

openssl rand -base64 756

启动docker-compose后集群无法运行，抛出错误日志：

{"t":{"$date":"2023-07-07T07:39:30.505+00:00"},"s":"I",  "c":"NETWORK",  "id":4915701, "ctx":"-","msg":"Initialized wire specification","attr":{"spec":{"incomingExternalClient":{"minWireVersion":0,"maxWireVersion":17},"incomingInternalClient":{"minWireVersion":0,"maxWireVersion":17},"outgoing":{"minWireVersion":6,"maxWireVersion":17},"isInternalClient":true}}}
{"t":{"$date":"2023-07-07T07:39:30.507+00:00"},"s":"I",  "c":"CONTROL",  "id":23285,   "ctx":"-","msg":"Automatically disabling TLS 1.0, to force-enable TLS 1.0 specify --sslDisabledProtocols 'none'"}
{"t":{"$date":"2023-07-07T07:39:30.508+00:00"},"s":"I",  "c":"NETWORK",  "id":4648601, "ctx":"main","msg":"Implicit TCP FastOpen unavailable. If TCP FastOpen is required, set tcpFastOpenServer, tcpFastOpenClient, and tcpFastOpenQueueSize."}
{"t":{"$date":"2023-07-07T07:39:30.513+00:00"},"s":"I",  "c":"ACCESS",   "id":20254,   "ctx":"main","msg":"Read security file failed","attr":{"error":{"code":30,"codeName":"InvalidPath","errmsg":"error opening file: /keys/keyFile: bad file"}}}
{"t":{"$date":"2023-07-07T07:39:30.514+00:00"},"s":"I",  "c":"SHARDING", "id":5847201, "ctx":"main","msg":"Balancer command scheduler stop requested"}
{"t":{"$date":"2023-07-07T07:39:30.514+00:00"},"s":"I",  "c":"ASIO",     "id":22582,   "ctx":"main","msg":"Killing all outstanding egress activity."}
{"t":{"$date":"2023-07-07T07:39:30.514+00:00"},"s":"F",  "c":"CONTROL",  "id":20575,   "ctx":"main","msg":"Error creating service context","attr":{"error":"Location5579201: Unable to acquire security key[s]"}}

已将KeyFile权限设置为600和400，但仍出现此错误，寻求解决方法。

• 确认KeyFile的路径与名称匹配
  错误提示/keys/keyFile无法打开，需检查：

  1. 宿主机上./docker/mongodb/r1/keys/、r2/keys/、r3/keys/目录下是否存在名为keyFile的文件，确保生成的密钥内容已正确写入该文件，而非仅执行命令未保存输出。
  2. 检查mongod.conf中security.keyFile配置项是否指向/keys/keyFile，路径和文件名需完全一致。

• 修复容器内文件的权限与所有者
  即使宿主机设置了600/400权限，容器内的文件所有者可能不是MongoDB运行用户（默认是mongodb用户，UID 999），需：

  1. 在宿主机上执行命令修改文件所有者：

     sudo chown 999:999 ./docker/mongodb/r1/keys/keyFile ./docker/mongodb/r2/keys/keyFile ./docker/mongodb/r3/keys/keyFile
     

  2. 确保权限设置正确：

     chmod 400 ./docker/mongodb/r1/keys/keyFile ./docker/mongodb/r2/keys/keyFile ./docker/mongodb/r3/keys/keyFile
     

• 统一使用同一个KeyFile
  副本集所有节点必须使用相同的KeyFile，不要为每个节点生成不同的密钥。将同一个keyFile文件复制到r1/keys/、r2/keys/、r3/keys/目录下，避免密钥不一致导致的认证失败。

• 检查卷挂载是否正确
  确认docker-compose中./docker/mongodb/rX/keys:/keys的挂载路径无误，宿主机目录存在且有读写权限，容器启动时没有出现挂载失败的警告。

• 验证KeyFile内容有效性
  确保生成的KeyFile内容是完整的base64字符串，无换行或多余字符。可以重新生成并写入文件：

  openssl rand -base64 756 > ./docker/mongodb/r1/keys/keyFile
  cp ./docker/mongodb/r1/keys/keyFile ./docker/mongodb/r2/keys/
  cp ./docker/mongodb/r1/keys/keyFile ./docker/mongodb/r3/keys/
  

  再重新设置权限和所有者。

内容的提问来源于stack exchange，提问作者soroush safari