OCI Ampere节点Docker容器中python-oracledb Thin客户端报DPY-6000错误

环境信息 #

• 基础镜像：使用buildx为arm64构建的python:3.10.9-slim
• 客户端库：oracledb==1.2.1
• Docker版本：20.10.22, build 3a2c30b
• Docker宿主机OS：5.4.17-2136.311.6.1.el8uek.aarch64

错误信息 #

应用使用thin客户端连接自治事务处理数据库时返回以下错误：

File "/app/utils/db_connection_managers/oracle_connection_manager.py", line 13, in __init__
    self.db_conn = oracledb.connect(
  File "/usr/local/lib/python3.10/site-packages/oracledb/connection.py", line 1013, in connect
    return conn_class(dsn=dsn, pool=pool, params=params, **kwargs)
  File "/usr/local/lib/python3.10/site-packages/oracledb/connection.py", line 135, in __init__
    impl.connect(params_impl)
  File "src/oracledb/impl/thin/connection.pyx", line 318, in oracledb.thin_impl.ThinConnImpl.connect
  File "src/oracledb/impl/thin/connection.pyx", line 206, in oracledb.thin_impl.ThinConnImpl._connect_with_params
  File "src/oracledb/impl/thin/connection.pyx", line 177, in oracledb.thin_impl.ThinConnImpl._connect_with_description
  File "src/oracledb/impl/thin/connection.pyx", line 105, in oracledb.thin_impl.ThinConnImpl._connect_with_address
  File "src/oracledb/impl/thin/connection.pyx", line 101, in oracledb.thin_impl.ThinConnImpl._connect_with_address
  File "src/oracledb/impl/thin/protocol.pyx", line 168, in oracledb.thin_impl.Protocol._connect_phase_one
  File "src/oracledb/impl/thin/protocol.pyx", line 344, in oracledb.thin_impl.Protocol._process_message
  File "src/oracledb/impl/thin/protocol.pyx", line 323, in oracledb.thin_impl.Protocol._process_message
  File "src/oracledb/impl/thin/messages.pyx", line 1676, in oracledb.thin_impl.ConnectMessage.process
  File "/usr/local/lib/python3.10/site-packages/oracledb/errors.py", line 111, in _raise_err
    raise exc_type(_Error(message)) from cause
oracledb.exceptions.OperationalError: DPY-6000: cannot connect to database. Listener refused connection. (Similar to ORA-12506)

关键观察 #

在Intel架构Mac上，使用相同Dockerfile（构建为amd64）和连接信息运行同一容器时无异常。

排查与解决方案 #

• 升级oracledb版本：oracledb 1.2.1属于较早版本，对arm64架构的thin客户端支持存在兼容性短板。建议升级到2.x系列的最新稳定版，新版本针对arm架构做了针对性适配优化，大概率能解决连接问题。
• 检查网络与安全组配置：确认OCI Ampere节点的安全组规则是否允许容器访问自治数据库的端口（通常为1521或Wallet配置中的端口）。同时在容器内执行nslookup <数据库FQDN>，对比Mac上的解析结果，排查DNS解析异常。
• 验证Wallet文件权限与路径：确保arm64容器内的Wallet文件路径正确，且应用进程拥有读取权限。可在容器内执行ls -l <wallet目录>检查权限，必要时调整目录或文件权限。
• 补充镜像SSL依赖：python:3.10.9-slim的arm64镜像可能精简了SSL证书相关依赖，导致thin客户端无法完成SSL验证。在Dockerfile中添加以下命令安装证书包：

  RUN apt-get update && apt-get install -y ca-certificates && rm -rf /var/lib/apt/lists/*
  

• 调整连接参数：尝试显式指定SSL相关参数，测试是否能绕过兼容性问题（生产环境需谨慎使用）：

  oracledb.connect(user=user, password=password, dsn=dsn, ssl_server_dn_match=False)
  

  或显式指定Wallet位置：

  oracledb.connect(user=user, password=password, dsn=dsn, wallet_location="/path/to/wallet")
  

内容的提问来源于stack exchange，提问作者Babak Tourani