Azure App Service中Docker-Compose部署MongoDB遇WiredTiger启动错误求助

部署在Azure App Service的MongoDB容器，通过docker-compose挂载Azure File共享到自定义路径/var/mydata，启动时反复出现WiredTiger无法打开WiredTiger.wt文件的错误，报错Operation not permitted，同时会自动重命名该文件为WiredTiger.wt.N，多次重试后容器终止。已确认文件共享可正常创建/删除文件，权限测试无问题，但仅MongoDB无法正常读写。

相关配置 #

docker-compose.yml #

version: '3.4'
services:
  mongo:
    image: myrepo/myrepo:mongo-1
    restart: always
    volumes:
      - mongo:/var/mydata
    environment:
      MONGO_INITDB_ROOT_USERNAME: xxx
      MONGO_INITDB_ROOT_PASSWORD: xxx
    ports:
      - "27017:27107"
    networks:
      - app-network

volumes:
  mongo:
    driver: azure_file
    driver_opts:
      share_name: mongo
      storage_account_name: xxx
      storage_account_key: xxx

networks:
  app-network:

自定义Mongo镜像Dockerfile #

FROM mongo
EXPOSE 27017
 
ENTRYPOINT ["mongod", "--dbpath=/var/mydata", "--bind_ip_all"]

容器错误日志 #

2023-02-26T20:41:30.809321991Z {"t":{"$date":"2023-02-26T20:41:30.809+00:00"},"s":"I",  "c":"WT",       "id":22430,   "ctx":"initandlisten","msg":"WiredTiger message","attr":{"message":{"ts_sec":1677444090,"ts_usec":809021,"thread":"14:0x7dfcbbc19cc0","session_name":"connection","category":"WT_VERB_BLOCK","category_id":3,"verbose_level":"NOTICE","verbose_level_id":-1,"msg":"unexpected file WiredTiger.wt found, renamed to WiredTiger.wt.7"}}}
2023-02-26T20:41:30.840231616Z {"t":{"$date":"2023-02-26T20:41:30.839+00:00"},"s":"E",  "c":"WT",       "id":22435,   "ctx":"initandlisten","msg":"WiredTiger error message","attr":{"error":1,"message":{"ts_sec":1677444090,"ts_usec":839910,"thread":"14:0x7dfcbbc19cc0","session_name":"connection","category":"WT_VERB_DEFAULT","category_id":9,"verbose_level":"ERROR","verbose_level_id":-3,"msg":"__posix_open_file:805:/var/mydata/WiredTiger.wt: handle-open: open","error_str":"Operation not permitted","error_code":1}}}
2023-02-26T20:41:31.002537945Z {"t":{"$date":"2023-02-26T20:41:31.002+00:00"},"s":"E",  "c":"WT",       "id":22435,   "ctx":"initandlisten","msg":"WiredTiger error message","attr":{"error":17,"message":{"ts_sec":1677444091,"ts_usec":2211,"thread":"14:0x7dfcbbc19cc0","session_name":"connection","category":"WT_VERB_DEFAULT","category_id":9,"verbose_level":"ERROR","verbose_level_id":-3,"msg":"__posix_open_file:805:/var/mydata/WiredTiger.wt: handle-open: open","error_str":"File exists","error_code":17}}}
2023-02-26T20:41:31.050284867Z {"t":{"$date":"2023-02-26T20:41:31.050+00:00"},"s":"I",  "c":"WT",       "id":22430,   "ctx":"initandlisten","msg":"WiredTiger message","attr":{"message":{"ts_sec":1677444091,"ts_usec":50047,"thread":"14:0x7dfcbbc19cc0","session_name":"connection","category":"WT_VERB_BLOCK","category_id":3,"verbose_level":"NOTICE","verbose_level_id":-1,"msg":"unexpected file WiredTiger.wt found, renamed to WiredTiger.wt.8"}}}
2023-02-26T20:41:31.080410844Z {"t":{"$date":"2023-02-26T20:41:31.080+00:00"},"s":"E",  "c":"WT",       "id":22435,   "ctx":"initandlisten","msg":"WiredTiger error message","attr":{"error":1,"message":{"ts_sec":1677444091,"ts_usec":80113,"thread":"14:0x7dfcbbc19cc0","session_name":"connection","category":"WT_VERB_DEFAULT","category_id":9,"verbose_level":"ERROR","verbose_level_id":-3,"msg":"__posix_open_file:805:/var/mydata/WiredTiger.wt: handle-open: open","error_str":"Operation not permitted","error_code":1}}}
2023-02-26T20:41:31.097099487Z {"t":{"$date":"2023-02-26T20:41:31.096+00:00"},"s":"W",  "c":"STORAGE",  "id":22347,   "ctx":"initandlisten","msg":"Failed to start up WiredTiger under any compatibility version. This may be due to an unsupported upgrade or downgrade."}
2023-02-26T20:41:31.097778289Z {"t":{"$date":"2023-02-26T20:41:31.097+00:00"},"s":"F",  "c":"STORAGE",  "id":28595,   "ctx":"initandlisten","msg":"Terminating.","attr":{"reason":"1: Operation not permitted"}}
2023-02-26T20:41:31.098377890Z {"t":{"$date":"2023-02-26T20:41:31.097+00:00"},"s":"F",  "c":"ASSERT",   "id":23091,   "ctx":"initandlisten","msg":"Fatal assertion","attr":{"msgid":28595,"file":"src/mongo/db/storage/wiredtiger/wiredtiger_kv_engine.cpp","line":708}}

已尝试的解决方案 #

• 修改容器启动脚本，手动设置/var/mydata权限为777并指定属主/属组为root后启动MongoDB：

CMD [ "sh", "-c", "ls -l /var; touch /var/mydata/test.txt; rm /var/mydata/test.txt; chmod -R 777 /var/mydata; chown -R root /var/mydata; chgrp root /var/mydata; mongod --dbpath=/var/mydata --bind_ip_all" ]

• 通过自定义镜像复制MongoDB配置文件指定数据库路径，问题未解决

排查思路 #

1. Azure File共享协议兼容性：Azure File共享支持SMB 3.0/2.1，WiredTiger对文件系统的原子操作、锁机制有要求，确认共享使用的SMB版本是否满足MongoDB需求，尝试切换SMB版本测试。
2. MongoDB用户权限：官方Mongo镜像默认以mongodb用户而非root运行，即使手动设置目录权限为root，MongoDB进程实际运行用户可能无足够权限执行WiredTiger的底层文件操作，尝试修改镜像以mongodb用户启动，并确保该用户对/var/mydata有读写权限。
3. WiredTiger配置调整：添加--wiredTigerEngineConfigString="cache_size=1G,log=(enabled=false)"参数禁用WiredTiger日志或调整缓存配置，排查是否是日志文件操作触发权限问题。
4. Azure App Service容器限制：Azure App Service对容器有部分权限限制，尝试在本地环境挂载SMB共享测试相同配置，确认是否是App Service环境特有的限制。
5. 文件共享缓存一致性：Azure File共享的缓存机制可能导致文件状态不一致，尝试禁用共享的缓存（设置cache=none）后测试。
6. MongoDB版本匹配：确认自定义镜像使用的MongoDB版本与WiredTiger版本兼容，尝试更换不同MongoDB版本镜像测试。

内容的提问来源于stack exchange，提问作者PoorbandTony