如何解决docker-entrypoint.sh权限拒绝错误？

问题描述 #

执行docker-compose up -d后仅mysql容器能正常启动，其余容器启动时均报错：

Error invoking remote method 'docker-start-container': Error: (HTTP code 400) unexpected - failed to create task for container: failed to create shim task: OCI runtime create failed: runc create failed: unable to start container process: exec: "/usr/local/bin/docker-entrypoint.sh": permission denied: unknown

镜像构建过程中已确认docker-entrypoint.sh路径正确且具备可执行权限（日志显示权限为-rwxr-xr-x）。

相关配置文件 #

Dockerfile #

FROM centos:7

LABEL org.opencontainers.image.title="tig-slurm-cluster" \
      org.opencontainers.image.description="Slurm Docker cluster with TIG stack on CentOS 7" \
      org.label-schema.docker.cmd="docker-compose up -d" \

    

ARG SLURM_TAG=slurm-22-05-2-1
ARG GOSU_VERSION=1.11

RUN set -ex \
    && yum makecache fast \
    && yum -y update \
    && yum -y install epel-release \
    && yum -y install \
       wget \
       bzip2 \
       perl \
       gcc \
       gcc-c++\
       git \
       gnupg \
       #lua \
       #lua-devel \
       make \
       munge \
       munge-devel \
       python-devel \
       python-pip \
       python36 \
       python36-devel \
       python36-pip \
       mariadb-server \
       mariadb-devel \
       psmisc \
       bash-completion \
       vim-enhanced \
    && yum clean all \
    && rm -rf /var/cache/yum
    

#RUN pip install Cython nose && pip3.6 install Cython nose \
#    && pip3.6 install mysql-connector-python python-daemon


RUN set -ex \
    && wget -O /usr/local/bin/gosu "https://github.com/tianon/gosu/releases/download/$GOSU_VERSION/gosu-amd64" \
    && wget -O /usr/local/bin/gosu.asc "https://github.com/tianon/gosu/releases/download/$GOSU_VERSION/gosu-amd64.asc" \
    && export GNUPGHOME="$(mktemp -d)" \
    && gpg --batch --keyserver hkps://keys.openpgp.org --recv-keys B42F6819007F00F88E364FD4036A9C25BF357DD4 \
    && gpg --batch --verify /usr/local/bin/gosu.asc /usr/local/bin/gosu \
    && rm -rf "${GNUPGHOME}" /usr/local/bin/gosu.asc \
    && chmod +x /usr/local/bin/gosu \
    && gosu nobody true

RUN set -x \
    && git clone https://github.com/SchedMD/slurm.git \
    && pushd slurm \
    && git checkout tags/$SLURM_TAG \
    && ./configure --enable-debug --prefix=/usr --sysconfdir=/etc/slurm \
        --with-mysql_config=/usr/bin  --libdir=/usr/lib64 \
    && make install \
    && install -D -m644 etc/cgroup.conf.example /etc/slurm/cgroup.conf.example \
    && install -D -m644 etc/slurm.conf.example /etc/slurm/slurm.conf.example \
    && install -D -m644 etc/slurmdbd.conf.example /etc/slurm/slurmdbd.conf.example \
    && install -D -m644 contribs/slurm_completion_help/slurm_completion.sh /etc/profile.d/slurm_completion.sh \
    && popd \
   # && rm -rf slurm \
    && groupadd -r --gid=995 slurm \
    && useradd -r -g slurm --uid=995 slurm \
    && mkdir /etc/sysconfig/slurm \
        /var/spool/slurmd \
        /var/run/slurmd \
        /var/run/slurmdbd \
        /var/lib/slurmd \
        /var/log/slurm \
        /data \
    && touch /var/lib/slurmd/node_state \
        /var/lib/slurmd/front_end_state \
        /var/lib/slurmd/job_state \
        /var/lib/slurmd/resv_state \
        /var/lib/slurmd/trigger_state \
        /var/lib/slurmd/assoc_mgr_state \
        /var/lib/slurmd/assoc_usage \
        /var/lib/slurmd/qos_usage \
        /var/lib/slurmd/fed_mgr_state \
    && chown -R slurm:slurm /var/*/slurm* \
    && /sbin/create-munge-key \
    && pwd

ARG SUBMIT_VERSION=unknown




COPY slurm.conf /etc/slurm/slurm.conf
COPY slurmdbd.conf /etc/slurm/slurmdbd.conf

COPY docker-entrypoint.sh /usr/local/bin/docker-entrypoint.sh
RUN ["chmod", "+x", "/usr/local/bin/docker-entrypoint.sh"]
RUN ["ls", "-la", "/usr/local/bin/"]
ENTRYPOINT ["/usr/local/bin/docker-entrypoint.sh"]

CMD ["slurmdbd"]

docker-compose.yml #

version: "0.1"

services:
  mysql:
    image: mysql
    hostname: mysql
    container_name: mysql
    environment:
      MYSQL_ROOT_PASSWORD: rootpassword
      MYSQL_DATABASE: slurm_acct_db
      MYSQL_USER: slurm
      MYSQL_PASSWORD: password
      MYSQL_ROOT_HOST: "%"
#      MYSQL_HOST: "%"
    ports:
      - '3306:3306'
    volumes:
      - var_lib_mysql:/var/lib/mysql

  slurmdbd:
    image: tig-slurm-cluster:22.05.2
    command: ["slurmdbd"]
    container_name: slurmdbd
    hostname: slurmdbd
    volumes:
      - etc_munge:/etc/munge
      - etc_slurm:/etc/slurm
      - var_log_slurm:/var/log/slurm
      - usr:/usr
    expose:
      - "6819"
    depends_on:
      - mysql

  slurmctld:
    image: tig-slurm-cluster:22.05.2
    command: ["slurmctld"]
    container_name: slurmctld
    hostname: slurmctld
    volumes:
      - etc_munge:/etc/munge
      - etc_slurm:/etc/slurm
      - slurm_jobdir:/home
      - var_log_slurm:/var/log/slurm
      - usr:/usr
    expose:
      - "6817"
    depends_on:
      - "slurmdbd"

  c1:
    image: tig-slurm-cluster:22.05.2
    command: ["slurmd"]
    hostname: c1
    container_name: c1
    volumes:
      - etc_munge:/etc/munge
      - etc_slurm:/etc/slurm
      - slurm_jobdir:/home/
      - var_log_slurm:/var/log/slurm
      - usr:/usr
    expose:
      - "6818"
    depends_on:
      - "slurmctld"

  c2:
    image: tig-slurm-cluster:22.05.2
    command: ["slurmd"]
    hostname: c2
    container_name: c2
    volumes:
      - etc_munge:/etc/munge
      - etc_slurm:/etc/slurm
      - slurm_jobdir:/home
      - var_log_slurm:/var/log/slurm
      - usr:/usr
    expose:
      - "6818"
    depends_on:
      - "slurmctld"

volumes:
  etc_munge:
  etc_slurm:
  slurm_jobdir:
  var_lib_mysql:
  var_log_slurm:
  usr:

构建时权限确认日志 #

#14 [10/10] RUN ["ls", "-la", "/usr/local/bin/"]
#14 0.160 total 2264
#14 0.160 drwxr-xr-x 1 root root    4096 Jun 21 15:41 .
#14 0.160 drwxr-xr-x 1 root root    4096 Nov 13  2020 ..
#14 0.160 -rwxr-xr-x 1 root root    1588 Jun 21 14:24 docker-entrypoint.sh
#14 0.160 -rwxr-xr-x 1 root root 2294944 Dec  7  2021 gosu

问题原因及解决方案 #

原因分析 #

docker-compose中所有非mysql容器都挂载了usr:/usr匿名卷，容器启动时该卷会覆盖镜像内的整个/usr目录，导致原本存在于镜像/usr/local/bin下的docker-entrypoint.sh被卷内空内容或无关文件替代，最终触发权限拒绝错误。

解决方案 #

1. 编辑docker-compose.yml，移除所有服务中的- usr:/usr挂载配置。/usr是镜像构建时安装Slurm等核心工具的目录，无需通过卷挂载，否则会破坏镜像原有目录结构。
2. 清理旧容器和卷后重新启动：

docker-compose down -v
docker-compose up -d

额外说明 #

如果确实需要挂载/usr下的特定子目录（如自定义插件、配置），请挂载具体子路径，不要直接挂载整个/usr目录。

内容的提问来源于stack exchange，提问作者abinitio