Ubuntu虚拟服务器无法启动全部Docker容器求助

问题背景 #

4核8GB内存的Ubuntu 22.04虚拟服务器，通过Docker Compose部署以下架构：

• Traefik作为反向代理分发流量
• Crowdsec提供安全防护并作为Traefik中间件
• 应用包含Gitea、Nextcloud及基础Apache/PHP Web服务器
• Watchtower管理容器自动更新

初始问题：启动最后一个容器时，其他容器因内存耗尽（退出码137）被强制终止。添加资源限制后，容器不再被终止，但始终无法启动最后一个容器，随机出现三类错误。

已配置的资源限制（docker-compose.yml） #

deploy:
  resources:
    limits:
      cpus: '0.001'
      memory: 50M
    reservations:
      cpus: '0.0001'
      memory: 20M

出现的错误信息 #

错误1：线程创建资源不足 #

$ docker compose up -d
[+] Running 3/4
 ⠿ Network nextcloud_default  Created                                                                                                                                                                        3.5s
 ⠿ Container nextcloud-redis  Started                                                                                                                                                                        1.3s
 ⠿ Container nextcloud-db     Starting                                                                                                                                                                       2.1s
 ⠿ Container nextcloud-app    Created                                                                                                                                                                        0.2s
Error response from daemon: failed to create shim task: OCI runtime create failed: runc create failed: unable to start container process: error during container init: error running hook #0: error running hook: exit status 2, stdout: , stderr: runtime/cgo: pthread_create failed: Resource temporarily unavailable
SIGABRT: abort 

goroutine 0 [idle]:
runtime: unknown pc 0x7f6605cd0a7c
stack: frame={sp:0x7ffd4137b1a0, fp:0x0} stack=[0x7ffd40b7c810,0x7ffd4137b850)
0x00007ffd4137b0a0:  0x000055de6cee2154 <runtime.funcspdelta+0x0000000000000034> ...

错误2：cgroup CPU配额写入失败 #

$ docker compose up -d
...
Error response from daemon: failed to create shim task: OCI runtime create failed: runc create failed: unable to start container process: error during container init: error setting cgroup config for procHooks process: failed to write "380000": write /sys/fs/cgroup/cpu,cpuacct/docker/dfbfa79b7a987b1248a5498fbd6fe4438a68cb0e147a3285a8638a845193f4bf/cpu.cfs_quota_us: invalid argument: unknown

错误3：sudo执行时无法获取OCI运行时日志 #

$ sudo docker compose up -d
...
Error response from daemon: failed to create shim task: OCI runtime create failed: unable to retrieve OCI runtime error (open /run/containerd/io.containerd.runtime.v2.task/moby/dfbfa79b7a987b1248a5498fbd6fe4438a68cb0e147a3285a8638a845193f4bf/log.json: no such file or directory): runc did not terminate successfully: exit status 2: unknown

已完成的排查操作 #

• 通过htop和docker stats确认：CPU使用率仅1-5%，内存仅占用800M，无明显资源耗尽
• 尝试增大vm.min_free_kbytes参数，无效
• 检查ulimit结果为unlimited
• 查阅GitHub相关Issue，但因对Linux系统了解有限，未找到匹配的解决方案

服务器环境信息 #

$ docker --version
Docker version 20.10.23, build 7155243

$ uname -r
5.2.0

$ lscpu
Architecture:            x86_64
  CPU op-mode(s):        32-bit, 64-bit
  Address sizes:         46 bits physical, 48 bits virtual
  Byte Order:            Little Endian
CPU(s):                  4
  On-line CPU(s) list:   0-3
Vendor ID:               GenuineIntel
  Model name:            Intel(R) Xeon(R) CPU E5-2680 v3 @ 2.50GHz
    CPU family:          6
    Model:               63
    Thread(s) per core:  2
    Core(s) per socket:  4
    Socket(s):           1
    Stepping:            2
    BogoMIPS:            4994.44
    Flags:               fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush dts acpi mmx fxsr sse sse2 ss ht tm pbe syscall nx pdpe1gb rdtscp lm constant_tsc arch_perfmon pebs bts rep_good nopl xtopology nons
                         top_tsc aperfmperf eagerfpu cpuid_faulting pni pclmulqdq dtes64 monitor ds_cpl vmx smx est tm2 ssse3 sdbg fma cx16 xtpr pdcm pcid dca sse4_1 sse4_2 x2apic movbe popcnt tsc_deadline_timer aes xsave avx f16c rdrand
                          lahf_lm abm epb invpcid_single intel_ppin ssbd ibrs ibpb stibp tpr_shadow vnmi flexpriority ept vpid fsgsbase tsc_adjust bmi1 avx2 smep bmi2 erms invpcid cqm xsaveopt cqm_llc cqm_occup_llc dtherm ida arat pln pt
                         s md_clear spec_ctrl intel_stibp flush_l1d
Virtualization features:
  Virtualization:        VT-x
  Hypervisor vendor:     Parallels
  Virtualization type:   container
Caches (sum of all):
  L1d:                   128 KiB (4 instances)
  L1i:                   128 KiB (4 instances)
  L2:                    1 MiB (4 instances)
  L3:                    30 MiB (1 instance)

$ lsb_release -a
No LSB modules are available.
Distributor ID: Ubuntu
Description:    Ubuntu 22.04.1 LTS
Release:        22.04
Codename:       jammy

解决思路 #

1. 修正CPU资源限制配置
   当前设置的cpus: '0.001'和cpus: '0.0001'过小，会导致cgroup的CPU配额计算异常（如错误2中的无效参数）。建议调整为合理值：

   • 轻量容器（Watchtower、Crowdsec）：limits.cpus: '0.5'，reservations.cpus: '0.1'
   • 应用容器（Nextcloud、Gitea）：limits.cpus: '1.5'，reservations.cpus: '0.5'
     总CPU配额不要超过服务器4核上限。

2. 切换到cgroup v1
   Ubuntu 22.04默认使用cgroup v2，但Docker 20.10对其兼容性不佳，尤其是在Parallels虚拟化环境下。切换步骤：

   • 编辑/etc/default/grub，修改GRUB_CMDLINE_LINUX为：GRUB_CMDLINE_LINUX="systemd.unified_cgroup_hierarchy=0"
   • 更新grub：sudo update-grub
   • 重启服务器：sudo reboot

3. 调整系统进程数限制
   错误1中的线程创建失败可能是PID数耗尽导致的：

   • 查看当前PID上限：cat /proc/sys/kernel/pid_max
   • 临时调整上限：echo 65536 | sudo tee /proc/sys/kernel/pid_max
   • 永久生效：编辑/etc/sysctl.conf，添加kernel.pid_max = 65536，执行sudo sysctl -p

4. 升级Docker版本
   当前使用的Docker 20.10.23存在cgroup和runc相关bug，升级到最新稳定版：

   sudo apt-get update
   sudo apt-get install docker-ce docker-ce-cli containerd.io
   

5. 排查虚拟化环境限制
   服务器基于Parallels虚拟化，可能宿主机对容器有隐性限制（如PID数、cgroup权限），可联系服务商确认，或在非Parallels环境下测试部署。

内容的提问来源于stack exchange，提问作者DJLax5