Come for the products,
stay for the community

The Atlassian Community can help you and your team get more value out of Atlassian products and practices.

Atlassian Community about banner
4,298,079
Community Members
 
Community Events
165
Community Groups

Broken starting clickhouse in a docker because of wrong capabilities request

Hi there,

 

We are installing and starting the clickhouse server in a docker image while pipelining our application.

Till several days ago (the last successful pipeline is May 7th, 2021) it was working fine.

But today the pipeline has broken and the message appears:

/etc/init.d/clickhouse-server: 94: clickhouse: Operation not permitted


We were searching for a problem and found a difference in a building sequence.

In the (old) success pipeline, there was the following log while installing clickhouse:

Setting capabilities for clickhouse binary. This is optional.
command -v setcap >/dev/null && echo > /tmp/test_setcap.sh && chmod a+x /tmp/test_setcap.sh && /tmp/test_setcap.sh && setcap 'cap_net_admin,cap_ipc_lock,cap_sys_nice+ep' /tmp/test_setcap.sh && /tmp/test_setcap.sh && rm /tmp/test_setcap.sh && setcap 'cap_net_admin,cap_ipc_lock,cap_sys_nice+ep' /usr/bin/clickhouse || echo "Cannot set 'net_admin' or 'ipc_lock' or 'sys_nice' capability for clickhouse binary. This is optional. Taskstats accounting will be disabled. To enable taskstats accounting you may add the required capability later manually."
sh: 1: /tmp/test_setcap.sh: Operation not permitted
Cannot set 'net_admin' or 'ipc_lock' or 'sys_nice' capability for clickhouse binary. This is optional. Taskstats accounting will be disabled. To enable taskstats accounting you may add the required capability later manually.

 

The (new) broken pipeline reported on the same place:

Setting capabilities for clickhouse binary. This is optional.
command -v setcap >/dev/null && echo > /tmp/test_setcap.sh && chmod a+x /tmp/test_setcap.sh && /tmp/test_setcap.sh && setcap 'cap_net_admin,cap_ipc_lock,cap_sys_nice+ep' /tmp/test_setcap.sh && /tmp/test_setcap.sh && rm /tmp/test_setcap.sh && setcap 'cap_net_admin,cap_ipc_lock,cap_sys_nice+ep' /usr/bin/clickhouse || echo "Cannot set 'net_admin' or 'ipc_lock' or 'sys_nice' capability for clickhouse binary. This is optional. Taskstats accounting will be disabled. To enable taskstats accounting you may add the required capability later manually."

 

So the sequence is the following:

The installation script creates a test batch, sets up capabilities, and tries to start the script. If the test script starts fine, it sets up capabilities for the clickhouse binary. Else the caps are not set, and the clickhouse is running in user mode.

But in the last broken pipeline, this sequence has broken.
Though the capabilities are still forbidden, the test script has started successfully, and the clickhouse binary has got these caps. But when the clickhouse binary itself has tried to start, it was forbidden because these caps are forbidden.

The found workaround is to add the following code immediately after the clickhouse installation in the Dockerfile:


RUN setcap -r `which clickhouse` && echo "Cleaning caps success" || echo "Cleaning caps error"

What do you think about it?

 

2 comments

Comment

Log in or Sign up to comment
TAGS
Community showcase
Published in Bitbucket

Git push size limits are coming to Bitbucket Cloud starting April 4th, 2022

Beginning on April 4th, we will be implementing push limits. This means that your push cannot be completed if it is over 3.5 GB. If you do attempt to complete a push that is over 3.5 GB, it will fail...

2,223 views 2 9
Read article

Community Events

Connect with like-minded Atlassian users at free events near you!

Find an event

Connect with like-minded Atlassian users at free events near you!

Unfortunately there are no Community Events near you at the moment.

Host an event

You're one step closer to meeting fellow Atlassian users at your local event. Learn more about Community Events

Events near you