Docker中OpenJDK17环境下UnixSystem.getUsername()返回null问题

问题现象 #

• 以下代码在OSX系统可正常运行：

var hadoopInputFile  = org.apache.parquet.hadoop.util.HadoopInputFile.fromPath(parquetPath, new Configuration())

• 但在Linux的Docker容器中执行时抛出登录异常：

failure to login: javax.security.auth.login.LoginException: java.lang.NullPointerException: invalid null input: name
    at jdk.security.auth/com.sun.security.auth.UnixPrincipal.<init>(UnixPrincipal.java:67)
    at jdk.security.auth/com.sun.security.auth.module.UnixLoginModule.login(UnixLoginModule.java:134)
    at java.base/javax.security.auth.login.LoginContext.invoke(LoginContext.java:726)
    at java.base/javax.security.auth.login.LoginContext$4.run(LoginContext.java:665)
    at java.base/javax.security.auth.login.LoginContext$4.run(LoginContext.java:663)
    at java.base/java.security.AccessController.doPrivileged(AccessController.java:691)
    at java.base/javax.security.auth.login.LoginContext.invokePriv(LoginContext.java:663)
    at java.base/javax.security.auth.login.LoginContext.login(LoginContext.java:574)
    at org.apache.hadoop.security.UserGroupInformation$HadoopLoginContext.login(UserGroupInformation.java:2065)
    at org.apache.hadoop.security.UserGroupInformation.doSubjectLogin(UserGroupInformation.java:1975)
    at org.apache.hadoop.security.UserGroupInformation.createLoginUser(UserGroupInformation.java:719)
    at org.apache.hadoop.security.UserGroupInformation.getLoginUser(UserGroupInformation.java:669)
    at org.apache.hadoop.security.UserGroupInformation.getCurrentUser(UserGroupInformation.java:579)
    at org.apache.hadoop.fs.FileSystem$Cache$Key.<init>(FileSystem.java:3746)
    at org.apache.hadoop.fs.FileSystem$Cache$Key.<init>(FileSystem.java:3736)
    at org.apache.hadoop.fs.FileSystem$Cache.get(FileSystem.java:3520)
    at org.apache.hadoop.fs.FileSystem.get(FileSystem.java:540)
    at org.apache.hadoop.fs.FileSystem.get(FileSystem.java:288)
    at org.apache.hadoop.fs.FileSystem.get(FileSystem.java:524)
    at org.apache.hadoop.fs.Path.getFileSystem(Path.java:365)
    at org.apache.parquet.hadoop.util.HadoopInputFile.fromPath(HadoopInputFile.java:38)
...

根因排查 #

• 核心问题：new com.sun.security.auth.module.UnixSystem().getUsername()返回null，导致UnixPrincipal初始化时抛出空指针
• 容器环境细节：
  • Dockerfile配置：

    FROM maven:3.8.5-openjdk-17 AS tests
    ENV WORKDIR="/application"
    WORKDIR ${WORKDIR}
    COPY . $WORKDIR/
    

  • 启动命令：

    docker run
      --user 0:1001
      --volume $(command -v docker):/usr/bin/docker
      --volume /var/run/docker.sock:/var/run/docker.sock
      --volume $(pwd):/path/to/project/application
      app_tag bash -c
      "umask 002;
      mvn --settings ./.m2-settings.xml package"
    

  • 容器内验证：执行id返回uid=1001 gid=1001 groups=1001，但whoami报错whoami: cannot find name for user ID 1001——说明容器内/etc/passwd中没有UID 1001对应的用户条目，Java无法解析用户名

临时解决方案 #

在Dockerfile中预先创建匹配UID/GID的用户：

RUN groupadd -g 1001 sysadmin
RUN useradd appadmin -u 1001 -g 1001 -m -s /bin/bash

寻求更优方案 #

希望获取比预先创建用户更灵活的修复或规避方法，例如通过JVM参数、Hadoop配置调整等方式绕过对用户名解析的依赖。

内容的提问来源于stack exchange，提问作者Denis