Question

在Docker上运行多线程库时出现此错误。

Insufficient permissions to set thread priority. Please retry as root.

因此，我尝试使用-u选项运行映像，该选项指定使用ID为0的root用户运行/bin/bash：

docker run -u 0 --rm -it img bash

或

docker run -u root --rm -it img bash

如果我运行命令而不是像bash一样发生同样的情况

docker run -u root --rm -it img './threading_test'

但是实际上它不能解决权限问题，并且仍然会出现错误。

[更新]

添加Dockerfile

FROM ubuntu:18.04
MAINTAINER Loreto Parisi loretoparisi@gmail.com
RUN apt-get update && apt-get install -y libcap2-bin
COPY ./src .
CMD ["./y-cruncher"]

由于默认情况下未安装命令libcap2-bin，所以我添加了capsh。如建议的那样，capsh --print功能检查将返回

root@d24d02a2ee8c:/# capsh --print
Current: = cap_chown,cap_dac_override,cap_fowner,cap_fsetid,cap_kill,cap_setgid,cap_setuid,cap_setpcap,cap_net_bind_service,cap_net_raw,cap_sys_chroot,cap_sys_nice,cap_mknod,cap_audit_write,cap_setfcap+eip
Bounding set =cap_chown,cap_dac_override,cap_fowner,cap_fsetid,cap_kill,cap_setgid,cap_setuid,cap_setpcap,cap_net_bind_service,cap_net_raw,cap_sys_chroot,cap_sys_nice,cap_mknod,cap_audit_write,cap_setfcap
Securebits: 00/0x0/1'b0
 secure-noroot: no (unlocked)
 secure-no-suid-fixup: no (unlocked)
 secure-keep-caps: no (unlocked)
uid=0(root)
gid=0(root)
groups=

由于我默认在docker run --rm -it --cap-add=sys_nice y-cruncher中设置了CMD ["./y-cruncher"]，所以运行命令为Dockerfile。

Answer 1

似乎是一个应用程序问题。非docker执行具有相同的问题：

$ id
uid=0(root) gid=0(root) groups=0(root) context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
$ ./y-cruncher-static/y-cruncher | grep 'Insufficient'
Insufficient permissions to set thread priority. Please retry as root.

Docker执行：

$ docker run --rm -v $PWD/y-cruncher-static:/y-cruncher-static --privileged --security-opt seccomp=unconfined -ti ubuntu bash -c "/y-cruncher-static/y-cruncher | grep 'Insufficient'"
Insufficient permissions to set thread priority. Please retry as root.

调试信息：

$ capsh --print
Current: = cap_chown,cap_dac_override,cap_dac_read_search,cap_fowner,cap_fsetid,cap_kill,cap_setgid,cap_setuid,cap_setpcap,cap_linux_immutable,cap_net_bind_service,cap_net_broadcast,cap_net_admin,cap_net_raw,cap_ipc_lock,cap_ipc_owner,cap_sys_module,cap_sys_rawio,cap_sys_chroot,cap_sys_ptrace,cap_sys_pacct,cap_sys_admin,cap_sys_boot,cap_sys_nice,cap_sys_resource,cap_sys_time,cap_sys_tty_config,cap_mknod,cap_lease,cap_audit_write,cap_audit_control,cap_setfcap,cap_mac_override,cap_mac_admin,cap_syslog,35,36+ep
Bounding set =cap_chown,cap_dac_override,cap_dac_read_search,cap_fowner,cap_fsetid,cap_kill,cap_setgid,cap_setuid,cap_setpcap,cap_linux_immutable,cap_net_bind_service,cap_net_broadcast,cap_net_admin,cap_net_raw,cap_ipc_lock,cap_ipc_owner,cap_sys_module,cap_sys_rawio,cap_sys_chroot,cap_sys_ptrace,cap_sys_pacct,cap_sys_admin,cap_sys_boot,cap_sys_nice,cap_sys_resource,cap_sys_time,cap_sys_tty_config,cap_mknod,cap_lease,cap_audit_write,cap_audit_control,cap_setfcap,cap_mac_override,cap_mac_admin,cap_syslog,35,36
Securebits: 00/0x0/1'b0
 secure-noroot: no (unlocked)
 secure-no-suid-fixup: no (unlocked)
 secure-keep-caps: no (unlocked)
uid=0(root)
gid=0(root)
groups=0(root)
$ uname -a
Linux dockerhost 3.10.0-862.14.4.el7.x86_64 #1 SMP Wed Sep 26 15:12:11 UTC 2018 x86_64 x86_64 x86_64 GNU/Linux

Answer 2

通常，您需要使容器CAP_SYS_NICE能够设置优先级。

y-cruncher需要与root用户一起运行，否则将引发错误消息

赋予CAP_SYS_NICE功能之前的测试：

Launching y-cruncher...
================================================================
Insufficient permissions to set thread priority. Please retry as root.
Further messages for this warning will be suppressed.
Checking processor/OS features...
Required Features:
    x64, ABM, BMI1, BMI2, ADX,
    SSE, SSE2, SSE3, SSSE3, SSE4.1, SSE4.2,
    AVX, FMA3, AVX2
Parsing Core -> Handle Mappings...
    Cores:  0-3 
Parsing NUMA -> Core Mappings...
    Node  0:  0-3 
y-cruncher v0.7.7 Build 9499                ( www.numberworld.org )
Copyright 2008-2020 Alexander J. Yee      ( a-yee@u.northwestern.edu )

通过CAP_SYS_NICE为--cap-add=sys_nice ubuntu:latest提供功能后进行的测试

Launching y-cruncher...
================================================================
Checking processor/OS features...
Required Features:
    x64, ABM, BMI1, BMI2, ADX,
    SSE, SSE2, SSE3, SSSE3, SSE4.1, SSE4.2,
    AVX, FMA3, AVX2
Parsing Core -> Handle Mappings...
    Cores:  0-3 
Parsing NUMA -> Core Mappings...
    Node  0:  0-3 
y-cruncher v0.7.7 Build 9499                ( www.numberworld.org )
Copyright 2008-2020 Alexander J. Yee      ( a-yee@u.northwestern.edu )

值得一提的是要确保内核本身具有使用capsh --print启用的必需功能，但是默认情况下主机上应该存在CAP_SYS_NICE

Docker权限不足，无法设置线程优先级

2 个答案: