Hi there,
We are installing and starting the clickhouse server in a docker image while pipelining our application.
Till several days ago (the last successful pipeline is May 7th, 2021) it was working fine.
But today the pipeline has broken and the message appears:
/etc/init.d/clickhouse-server: 94: clickhouse: Operation not permitted
We were searching for a problem and found a difference in a building sequence.
In the (old) success pipeline, there was the following log while installing clickhouse:
Setting capabilities for clickhouse binary. This is optional.
command -v setcap >/dev/null && echo > /tmp/test_setcap.sh && chmod a+x /tmp/test_setcap.sh && /tmp/test_setcap.sh && setcap 'cap_net_admin,cap_ipc_lock,cap_sys_nice+ep' /tmp/test_setcap.sh && /tmp/test_setcap.sh && rm /tmp/test_setcap.sh && setcap 'cap_net_admin,cap_ipc_lock,cap_sys_nice+ep' /usr/bin/clickhouse || echo "Cannot set 'net_admin' or 'ipc_lock' or 'sys_nice' capability for clickhouse binary. This is optional. Taskstats accounting will be disabled. To enable taskstats accounting you may add the required capability later manually."
sh: 1: /tmp/test_setcap.sh: Operation not permitted
Cannot set 'net_admin' or 'ipc_lock' or 'sys_nice' capability for clickhouse binary. This is optional. Taskstats accounting will be disabled. To enable taskstats accounting you may add the required capability later manually.
The (new) broken pipeline reported on the same place:
Setting capabilities for clickhouse binary. This is optional.
command -v setcap >/dev/null && echo > /tmp/test_setcap.sh && chmod a+x /tmp/test_setcap.sh && /tmp/test_setcap.sh && setcap 'cap_net_admin,cap_ipc_lock,cap_sys_nice+ep' /tmp/test_setcap.sh && /tmp/test_setcap.sh && rm /tmp/test_setcap.sh && setcap 'cap_net_admin,cap_ipc_lock,cap_sys_nice+ep' /usr/bin/clickhouse || echo "Cannot set 'net_admin' or 'ipc_lock' or 'sys_nice' capability for clickhouse binary. This is optional. Taskstats accounting will be disabled. To enable taskstats accounting you may add the required capability later manually."
So the sequence is the following:
The installation script creates a test batch, sets up capabilities, and tries to start the script. If the test script starts fine, it sets up capabilities for the clickhouse binary. Else the caps are not set, and the clickhouse is running in user mode.
But in the last broken pipeline, this sequence has broken.
Though the capabilities are still forbidden, the test script has started successfully, and the clickhouse binary has got these caps. But when the clickhouse binary itself has tried to start, it was forbidden because these caps are forbidden.
The found workaround is to add the following code immediately after the clickhouse installation in the Dockerfile:
RUN setcap -r `which clickhouse` && echo "Cleaning caps success" || echo "Cleaning caps error"
What do you think about it?
