Univention Bugzilla – Bug 44033
UCS 4.2: Running "service docker restart" leaves all containers terminated
Last modified: 2017-04-04 18:28:20 CEST
Running "service docker restart" leaves all containers terminated. univention-docker ships a template for /etc/init.d/docker to restart running containers, but /lib/systemd/system/docker.service takes precedence. Maybe we can add this to the /etc/default/docker template: https://docs.docker.com/engine/admin/live-restore/#enable-the-live-restore-option We should also check if there are other changes in our init script that need to be migrated.
We have the following three special cases in our init script: 1. Linux Kernel: You need at least Kernel 4.1 to use it. I think we can skip this test. 2. Network conflict: If the docker default network overlaps with the default network, a log message has been shown. 3. The Firewall is restated. I guess we can add system diagnostic scripts for the first two issues if they are still relevant. The firewall restart has been added due to Bug #42698. Currently, I don't see why these changes are needed. Unfortunately, the bug doesn't describe the impact. So, I would recommend to add a new UCR variable which allows to define docker parameters and remove the old init script.
(In reply to Stefan Gohmann from comment #1) > The firewall restart has been added due to Bug #42698. Currently, I don't > see why these changes are needed. Unfortunately, the bug doesn't describe > the impact. OK, the reason is that we need some more firewall rules for example the MySQL settings. We could restart univention-firewall via ExecStartPos in the docker service.
r78226: univention-firewall * 20_docker.sh: Use 'pidof dockerd' instead of systemctl since the script is executed through systemd (Bug #44033) r78196: * Remove UCR template for /etc/init.d/docker. The systemd service will be used (Bug #44033) * Added a new UCR variable docker/daemon/default/parameter/.* to add additional parameter for the Docker daemon (Bug #44033) * Activate live-restore by default (Bug #44033) r78227: Changelog
/etc/init.d/docker still exists after the update (/etc/univention/templates/files/etc/init.d/docker has been removed). Sometimes after the restart a ssh login is not possible. Unfortunately, this happens not always. Strangely, iptables seems to be correct ACCEPT tcp -- anywhere anywhere tcp dpt:ssh but a ssh login does not work until i restart the firewall.
r17428: * Ensure that firewall init script has been finished (Bug #44033)
Now i had the situation that notifier port was blocked (and the join of other servers failed), after restarting the firewall, the notifier was reachable.
(In reply to Felix Botner from comment #6) > Now i had the situation that notifier port was blocked (and the join of > other servers failed), after restarting the firewall, the notifier was > reachable. Can you append the output of journalctl? I'm still unable to reproduce it.
(In reply to Stefan Gohmann from comment #7) > (In reply to Felix Botner from comment #6) > > Now i had the situation that notifier port was blocked (and the join of > > other servers failed), after restarting the firewall, the notifier was > > reachable. > > Can you append the output of journalctl? I'm still unable to reproduce it. I hope it has been fixed with: r17429 (docker.io 1.12.6-0ubuntu1~16.04.1A~4.2.0.201703241951): * Really ensure that firewall init script has been finished (Bug #44033) Waiting for my tests.
(In reply to Stefan Gohmann from comment #8) > (In reply to Stefan Gohmann from comment #7) > > (In reply to Felix Botner from comment #6) > > > Now i had the situation that notifier port was blocked (and the join of > > > other servers failed), after restarting the firewall, the notifier was > > > reachable. > > > > Can you append the output of journalctl? I'm still unable to reproduce it. > > I hope it has been fixed with: > > r17429 (docker.io 1.12.6-0ubuntu1~16.04.1A~4.2.0.201703241951): > * Really ensure that firewall init script has been finished (Bug #44033) > > Waiting for my tests. My tests were successful. Please try again,
-> docker ps && service docker restart && docker ps CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES 62af6cbcc624 docker.software-univention.de/ucs-appbox-amd64:4.1-3 "/sbin/init" 24 hours ago Up About a minute 0.0.0.0:40001->80/tcp, 0.0.0.0:40002->443/tcp awesome_mestorf ba7b239eb6f4 docker.software-univention.de/nextcloud:11.0.2-0 "/bin/sh -c /usr/sbin" 26 hours ago Up About a minute 0.0.0.0:40000->80/tcp trusting_hypatia CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES 62af6cbcc624 docker.software-univention.de/ucs-appbox-amd64:4.1-3 "/sbin/init" 24 hours ago Up About a minute 0.0.0.0:40001->80/tcp, 0.0.0.0:40002->443/tcp awesome_mestorf ba7b239eb6f4 docker.software-univention.de/nextcloud:11.0.2-0 "/bin/sh -c /usr/sbin" 26 hours ago Up About a minute 0.0.0.0:40000->80/tcp trusting_hypatia
UCS 4.2 has been released: https://docs.software-univention.de/release-notes-4.2-0-en.html https://docs.software-univention.de/release-notes-4.2-0-de.html If this error occurs again, please use "Clone This Bug".