Docker 中无法使用 JDK jmap之 Can't attach to the process: ptrace(PTRACE_ATTACH问题

痛定思痛。 2021-10-12 17:16 820阅读 0赞

问题描述

一个老服务最近出现OOM问题了(日志中发现的),但是由于启动参数没有添加 -XX:+HeapDumpOnOutOfMemoryError无法获取dump文件,这时想着使用jmap获取dump文件,结果执行jmap报如下错:

在这里插入图片描述

  1. # jmap -heap 6
  2. Attaching to process ID 6, please wait...
  3. Error attaching to process: sun.jvm.hotspot.debugger.DebuggerException: Can't attach to the process: ptrace(PTRACE_ATTACH, ..) failed for 6: Operation not permitted sun.jvm.hotspot.debugger.DebuggerException: sun.jvm.hotspot.debugger.DebuggerException: Can't attach to the process: ptrace(PTRACE_ATTACH, ..) failed for 6: Operation not permitted
  4. at sun.jvm.hotspot.debugger.linux.LinuxDebuggerLocal$LinuxDebuggerLocalWorkerThread.execute(LinuxDebuggerLocal.java:163)
  5. at sun.jvm.hotspot.debugger.linux.LinuxDebuggerLocal.attach(LinuxDebuggerLocal.java:278)
  6. at sun.jvm.hotspot.HotSpotAgent.attachDebugger(HotSpotAgent.java:671)
  7. at sun.jvm.hotspot.HotSpotAgent.setupDebuggerLinux(HotSpotAgent.java:611)
  8. at sun.jvm.hotspot.HotSpotAgent.setupDebugger(HotSpotAgent.java:337)
  9. at sun.jvm.hotspot.HotSpotAgent.go(HotSpotAgent.java:304)
  10. at sun.jvm.hotspot.HotSpotAgent.attach(HotSpotAgent.java:140)
  11. at sun.jvm.hotspot.tools.Tool.start(Tool.java:185)
  12. at sun.jvm.hotspot.tools.Tool.execute(Tool.java:118)
  13. at sun.jvm.hotspot.tools.HeapSummary.main(HeapSummary.java:49)
  14. at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
  15. at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
  16. at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
  17. at java.lang.reflect.Method.invoke(Method.java:498)
  18. at sun.tools.jmap.JMap.runTool(JMap.java:201)
  19. at sun.tools.jmap.JMap.main(JMap.java:130)
  20. Caused by: sun.jvm.hotspot.debugger.DebuggerException: Can't attach to the process: ptrace(PTRACE_ATTACH, ..) failed for 6: Operation not permitted
  21. at sun.jvm.hotspot.debugger.linux.LinuxDebuggerLocal.attach0(Native Method)
  22. at sun.jvm.hotspot.debugger.linux.LinuxDebuggerLocal.access$100(LinuxDebuggerLocal.java:62)
  23. at sun.jvm.hotspot.debugger.linux.LinuxDebuggerLocal$1AttachTask.doit(LinuxDebuggerLocal.java:269)
  24. at sun.jvm.hotspot.debugger.linux.LinuxDebuggerLocal$LinuxDebuggerLocalWorkerThread.run(LinuxDebuggerLocal.java:138)

问题分析

百度和google之后,我们发现docker的官方文档提到了。

这不是什么 docker 或者jmap的Bug,而是 Docker 自 1.10 版本开始加入的安全特性。 jmap 这类 JDK 工具依赖于 Linux 的 PTRACE_ATTACH,而 Docker 自 1.10 版本开始,默认的 seccomp 配置文件中禁用了 ptrace。

主要提及三种:

1.1 –security-opt seccomp=unconfined

直接关闭 seccomp 配置或者将ptrace添加到允许的名单中。用法:

  1. docker run --security-opt seccomp:unconfined ...

官方文档提到you can pass unconfined to run a container without the default seccomp profile. 连接为https://docs.docker.com/engine/security/seccomp/

1.2 –cap-add=SYS_PTRACE

使用 —cap-add 明确添加指定功能:

  1. docker run --cap-add=SYS_PTRACE ...

官方文档连接https://docs.docker.com/engine/reference/run/
在这里插入图片描述

1.3 Docker Compose 的支持

Docker Compose 自 version 1.1.0 (2015-02-25) 起支持 cap_add。官方文档:cap_add, cap_drop。用法:

前面的 docker-compose.yml 改写后文件内容如下(相同内容部分就不重复贴了):

  1. version: '2'
  2. services:
  3. mysql:
  4. ...
  5. api:
  6. ...
  7. cap_add:
  8. - SYS_PTRACE

官方连接在https://docs.docker.com/compose/compose-file/compose-file-v2/\#cap\_add-cap\_drop

最终解决办法

本人最终以类似如下方式启动容器,然后 执行jmap命令

在这里插入图片描述

  1. 启动容器的命令参数
  2. docker run --cap-add=SYS_PTRACE -d -p 8080:8080 hello:v2 --name helloWithPtrace
  3. # jmap -heap 6
  4. Attaching to process ID 6, please wait...
  5. Debugger attached successfully.
  6. Server compiler detected.
  7. JVM version is 25.162-b12
  8. using thread-local object allocation.
  9. Parallel GC with 2 thread(s)
  10. Heap Configuration:
  11. MinHeapFreeRatio = 0
  12. MaxHeapFreeRatio = 100
  13. MaxHeapSize = 782237696 (746.0MB)
  14. NewSize = 16777216 (16.0MB)
  15. MaxNewSize = 260571136 (248.5MB)
  16. OldSize = 33554432 (32.0MB)
  17. NewRatio = 2
  18. SurvivorRatio = 8
  19. MetaspaceSize = 21807104 (20.796875MB)
  20. CompressedClassSpaceSize = 1073741824 (1024.0MB)
  21. MaxMetaspaceSize = 17592186044415 MB
  22. G1HeapRegionSize = 0 (0.0MB)
  23. Heap Usage:
  24. Exception in thread "main" java.lang.reflect.InvocationTargetException
  25. at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
  26. at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
  27. at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
  28. at java.lang.reflect.Method.invoke(Method.java:498)
  29. at sun.tools.jmap.JMap.runTool(JMap.java:201)
  30. at sun.tools.jmap.JMap.main(JMap.java:130)
  31. Caused by: java.lang.RuntimeException: unknown CollectedHeap type : class sun.jvm.hotspot.gc_interface.CollectedHeap
  32. at sun.jvm.hotspot.tools.HeapSummary.run(HeapSummary.java:144)
  33. at sun.jvm.hotspot.tools.Tool.startInternal(Tool.java:260)
  34. at sun.jvm.hotspot.tools.Tool.start(Tool.java:223)
  35. at sun.jvm.hotspot.tools.Tool.execute(Tool.java:118)
  36. at sun.jvm.hotspot.tools.HeapSummary.main(HeapSummary.java:49)
  37. ... 6 more
  38. #

发表评论

表情:
评论列表 (有 0 条评论,820人围观)

还没有评论,来说两句吧...

相关阅读