检查docker所需的内核配置

下载检测配置脚本文件并运行

root@hi3798mv100:~# curl -O https://raw.githubusercontent.com/moby/moby/master/contrib/check-config.sh
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100 11376  100 11376    0     0   1899      0  0:00:05  0:00:05 --:--:--  3191
root@hi3798mv100:~# sh check-config.sh
warning: /proc/config.gz does not exist, searching other paths for kernel config ...
error: cannot find kernel config
  try running this script again, specifying the kernel config:
    CONFIG=/path/to/kernel/.config check-config.sh or check-config.sh /path/to/kernel/.config

结果报错/proc/config.gz不存在。接下来需要内核中开启IKCONFIG来解决这个报错。

配置内核开启IKCONFIG

下面操作在PC上进行
配置内核

/home/marsa/hi3798mv/HiSTBLinuxV100R005C00SPC060
$ make linux-menuconfig

确保下面两个配置选项全部打开

编译并烧写内核
可以通过Hi-Tool工具烧录，我这边拷贝内核镜像到机顶盒后使用dd指令烧录

/home/marsa/hi3798mv/HiSTBLinuxV100R005C00SPC060
$ make linux -j16
$ scp /home/marsa/hi3798mv/HiSTBLinuxV100R005C00SPC060/out/hi3798mv100/hi3798mdmo1f/image/emmc_image/hi_kernel.bin root@192.168.0.102:~
The authenticity of host '192.168.0.102 (192.168.0.102)' can't be established.
ECDSA key fingerprint is SHA256:SgWQyeWybvyGrKQgzDH/A2UJfUp+0FvYN4a7unIX998.
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added '192.168.0.102' (ECDSA) to the list of known hosts.
root@192.168.0.102's password:
hi_kernel.bin  

烧录内核，再次检测docker配置

烧录并重启

root@hi3798mv100:~# dd if=hi_kernel.bin of=/dev/mmcblk0p11
10191+1 records in
10191+1 records out
5218187 bytes (5.2 MB, 5.0 MiB) copied, 0.58894 s, 8.9 MB/s
root@hi3798mv100:~# reboot

检测docker配置

root@hi3798mv100:~# sh check-config.sh
info: reading kernel config from /proc/config.gz ...

Generally Necessary:
- cgroup hierarchy: nonexistent??
    (see https://github.com/tianon/cgroupfs-mount)
- CONFIG_NAMESPACES: enabled
- CONFIG_NET_NS: enabled
- CONFIG_PID_NS: enabled
- CONFIG_IPC_NS: enabled
- CONFIG_UTS_NS: enabled
- CONFIG_CGROUPS: enabled
- CONFIG_CGROUP_CPUACCT: missing
- CONFIG_CGROUP_DEVICE: missing
- CONFIG_CGROUP_FREEZER: missing
- CONFIG_CGROUP_SCHED: missing
- CONFIG_CPUSETS: missing
- CONFIG_MEMCG: missing
- CONFIG_KEYS: missing
- CONFIG_VETH: missing
- CONFIG_BRIDGE: enabled
- CONFIG_BRIDGE_NETFILTER: enabled
- CONFIG_IP_NF_FILTER: missing
- CONFIG_IP_NF_MANGLE: missing
- CONFIG_IP_NF_TARGET_MASQUERADE: missing
- CONFIG_IP6_NF_FILTER: missing
- CONFIG_IP6_NF_MANGLE: missing
- CONFIG_IP6_NF_TARGET_MASQUERADE: missing
- CONFIG_NETFILTER_XT_MATCH_ADDRTYPE: missing
- CONFIG_NETFILTER_XT_MATCH_CONNTRACK: missing
- CONFIG_NETFILTER_XT_MATCH_IPVS: missing
- CONFIG_NETFILTER_XT_MARK: missing
- CONFIG_IP_NF_RAW: missing
- CONFIG_IP_NF_NAT: missing
- CONFIG_NF_NAT: missing
- CONFIG_IP6_NF_RAW: missing
- CONFIG_IP6_NF_NAT: missing
- CONFIG_NF_NAT: missing
- CONFIG_POSIX_MQUEUE: missing
- CONFIG_DEVPTS_MULTIPLE_INSTANCES: missing
- CONFIG_NF_NAT_IPV4: missing
- CONFIG_NF_NAT_NEEDED: missing

Optional Features:
- CONFIG_USER_NS: missing
- CONFIG_SECCOMP: missing
- CONFIG_SECCOMP_FILTER: missing
- CONFIG_CGROUP_PIDS: missing
- CONFIG_MEMCG_SWAP: missing
- CONFIG_MEMCG_SWAP_ENABLED: missing
- CONFIG_MEMCG_KMEM: missing
- CONFIG_IOSCHED_CFQ: enabled
- CONFIG_CFQ_GROUP_IOSCHED: missing
- CONFIG_BLK_CGROUP: missing
- CONFIG_BLK_DEV_THROTTLING: missing
- CONFIG_CGROUP_PERF: missing
- CONFIG_CGROUP_HUGETLB: missing
- CONFIG_NET_CLS_CGROUP: missing
- CONFIG_CGROUP_NET_PRIO: missing
- CONFIG_CFS_BANDWIDTH: missing
- CONFIG_FAIR_GROUP_SCHED: missing
- CONFIG_IP_NF_TARGET_REDIRECT: missing
- CONFIG_IP_VS: missing
- CONFIG_IP_VS_NFCT: missing
- CONFIG_IP_VS_PROTO_TCP: missing
- CONFIG_IP_VS_PROTO_UDP: missing
- CONFIG_IP_VS_RR: missing
- CONFIG_SECURITY_SELINUX: missing
- CONFIG_SECURITY_APPARMOR: missing
- CONFIG_EXT3_FS: enabled
- CONFIG_EXT3_FS_XATTR: missing
- CONFIG_EXT3_FS_POSIX_ACL: enabled
- CONFIG_EXT3_FS_SECURITY: enabled
    (enable these ext3 configs if you are using ext3 as backing filesystem)
- CONFIG_EXT4_FS: enabled
- CONFIG_EXT4_FS_POSIX_ACL: enabled
- CONFIG_EXT4_FS_SECURITY: enabled
- Network Drivers:
  - "overlay":
    - CONFIG_VXLAN: missing
    - CONFIG_BRIDGE_VLAN_FILTERING: missing
      Optional (for encrypted networks):
      - CONFIG_CRYPTO: enabled
      - CONFIG_CRYPTO_AEAD: enabled (as module)
      - CONFIG_CRYPTO_GCM: enabled (as module)
      - CONFIG_CRYPTO_SEQIV: enabled (as module)
      - CONFIG_CRYPTO_GHASH: enabled (as module)
      - CONFIG_XFRM: enabled
      - CONFIG_XFRM_USER: missing
      - CONFIG_XFRM_ALGO: missing
      - CONFIG_INET_ESP: missing
      - CONFIG_NETFILTER_XT_MATCH_BPF: missing
      - CONFIG_INET_XFRM_MODE_TRANSPORT: enabled
  - "ipvlan":
    - CONFIG_IPVLAN: missing
  - "macvlan":
    - CONFIG_MACVLAN: missing
    - CONFIG_DUMMY: missing
  - "ftp,tftp client in container":
    - CONFIG_NF_NAT_FTP: missing
    - CONFIG_NF_CONNTRACK_FTP: missing
    - CONFIG_NF_NAT_TFTP: missing
    - CONFIG_NF_CONNTRACK_TFTP: missing
- Storage Drivers:
  - "btrfs":
    - CONFIG_BTRFS_FS: missing
    - CONFIG_BTRFS_FS_POSIX_ACL: missing
  - "overlay":
    - CONFIG_OVERLAY_FS: missing
  - "zfs":
    - /dev/zfs: missing
    - zfs command: missing
    - zpool command: missing

Limits:
cat: /proc/sys/kernel/keys/root_maxkeys: No such file or directory
check-config.sh: 386: [: Illegal number:
cat: /proc/sys/kernel/keys/root_maxkeys: No such file or directory
- /proc/sys/kernel/keys/root_maxkeys:

可以看到有很多配置缺少。需要在内核中补全这些配置。
我目前是把CONFIG_OVERLAY_FS选项和全部的Generally Necessary打开了。后续可能还需要再修改这部分内容。
重新烧写内核后发现在之前笔记中配置的wifi无法正常连接了。把重新生成的rtl8188eu.ko文件替换旧文件后wifi又可以正常使用了。

安装docker

安装

root@hi3798mv100:~# curl -fsSL https://get.docker.com | bash -s docker --mirror Aliyun

查看docker info

root@hi3798mv100:~# docker info
Client: Docker Engine - Community
 Version:    28.0.1
 Context:    default
 Debug Mode: false
 Plugins:
  buildx: Docker Buildx (Docker Inc.)
    Version:  v0.21.1
    Path:     /usr/libexec/docker/cli-plugins/docker-buildx
  compose: Docker Compose (Docker Inc.)
    Version:  v2.33.1
    Path:     /usr/libexec/docker/cli-plugins/docker-compose

Server:
 Containers: 0
  Running: 0
  Paused: 0
  Stopped: 0
 Images: 0
 Server Version: 28.0.1
 Storage Driver: overlay2
  Backing Filesystem: extfs
  Supports d_type: true
  Using metacopy: false
  Native Overlay Diff: true
  userxattr: false
 Logging Driver: json-file
 Cgroup Driver: cgroupfs
 Cgroup Version: 1
 Plugins:
  Volume: local
  Network: bridge host ipvlan macvlan null overlay
  Log: awslogs fluentd gcplogs gelf journald json-file local splunk syslog
 Swarm: inactive
 Runtimes: runc io.containerd.runc.v2
 Default Runtime: runc
 Init Binary: docker-init
 containerd version: bcc810d6b9066471b0b6fa75f557a15a1cbf31bb
 runc version: v1.2.4-0-g6c52b3f
 init version: de40ad0
 Kernel Version: 4.4.35_s40
 Operating System: Ubuntu 20.04.5 LTS
 OSType: linux
 Architecture: armv7l
 CPUs: 4
 Total Memory: 588MiB
 Name: hi3798mv100
 ID: b48629f3-432a-450c-aa77-98a89c39a02a
 Docker Root Dir: /var/lib/docker
 Debug Mode: false
 Experimental: false
 Insecure Registries:
  ::1/128
  127.0.0.0/8
 Live Restore Enabled: false

WARNING: No swap limit support
WARNING: No kernel memory TCP limit support
WARNING: No cpu cfs quota support
WARNING: No cpu cfs period support
WARNING: No blkio throttle.read_bps_device support
WARNING: No blkio throttle.write_bps_device support
WARNING: No blkio throttle.read_iops_device support
WARNING: No blkio throttle.write_iops_device support

好多WARNING，等爆炸吧

功能测试

添加代理

root@hi3798mv100:~# vi /lib/systemd/system/docker.service

[Unit]
Description=Docker Application Container Engine
Documentation=https://docs.docker.com
After=network-online.target nss-lookup.target docker.socket firewalld.service containerd.service time-set.target
Wants=network-online.target containerd.service
Requires=docker.socket

[Service]
Type=notify
# the default is not to use systemd for cgroups because the delegate issues still
# exists and systemd currently does not support the cgroup feature set required
# for containers run by docker
ExecStart=/usr/bin/dockerd -H fd:// --containerd=/run/containerd/containerd.sock
ExecReload=/bin/kill -s HUP $MAINPID
TimeoutStartSec=0
RestartSec=2
Restart=always

# Note that StartLimit* options were moved from "Service" to "Unit" in systemd 229.
# Both the old, and new location are accepted by systemd 229 and up, so using the old location
# to make them work for either version of systemd.
StartLimitBurst=3

# Note that StartLimitInterval was renamed to StartLimitIntervalSec in systemd 230.
# Both the old, and new name are accepted by systemd 230 and up, so using the old name to make
# this option work for either version of systemd.
StartLimitInterval=60s

# Having non-zero Limit*s causes performance problems due to accounting overhead
# in the kernel. We recommend using cgroups to do container-local accounting.
LimitNPROC=infinity
LimitCORE=infinity

# Comment TasksMax if your systemd version does not support it.
# Only systemd 226 and above support this option.
TasksMax=infinity

# set delegate yes so that systemd does not reset the cgroups of docker containers
Delegate=yes

# kill only the docker process, not all processes in the cgroup
KillMode=process
OOMScoreAdjust=-500

Environment="HTTP_PROXY=http://192.168.0.101:7890/"
Environment="HTTPS_PROXY=http://192.168.0.101:7890/"

[Install]
WantedBy=multi-user.target

root@hi3798mv100:~# systemctl daemon-reload
root@hi3798mv100:~# systemctl restart docker

拉取镜像，这里用python镜像试验

root@hi3798mv100:~# docker pull python:3.10
root@hi3798mv100:~# docker images
REPOSITORY   TAG       IMAGE ID       CREATED        SIZE
python       3.10      cd15ad512d6c   3 months ago   774MB
root@hi3798mv100:~# docker run -it python:3.10 /bin/bash
root@e6a6b5d7ed60:/# python -V
Python 3.10.16
root@e6a6b5d7ed60:/# exit
exit
root@hi3798mv100:~#

之前一直使用的SDK是HiSTBLinuxV100R005C00SPC050,在docker run 时会有下面的报错弄了几天都没有解决报错，最后把SDK换成了HiSTBLinuxV100R005C00SPC060才解决报错。如果有人知道报错的具体原因，欢迎留言！
level=error msg=“Handler for POST/v1.48/containers/d728099418f30a254771c939a88eae390b645efdeb77f94bd9d7222b596f53c9/start returned error: failed to set up container networking: updating gateway endpoint: failed to set gateway: route for the gateway 172.17.0.1 could not be found: decoding failed: buffer too small (4 bytes)”