打开查询日志文件时出错“file=/prometheus/ query ies.Active err=”打开/prometheus/query ies.active:权限被拒绝

Question

尝试使用非根用户运行prometheus，在尝试了https://github.com/prometheus/prometheus/issues/5976的许多建议后，它对我不起作用，我得到了：

level=error ts=xxxxxxxx caller=query_logger.go:87 component=activeQueryTracker msg="Error opening query log file" file=/prometheus/queries.active err="open /prometheus/queries.active: permission denied"
level=error ts=xxxxxxx caller=query_logger.go:87 component=activeQueryTracker msg="Error opening query log file" file=/prometheus/queries.active err="open /prometheus/queries.active: permission denied"
    
panic: Unable to create mmap-ed active query log
    panic: Unable to create mmap-ed active query log

下面是我的Dockerfile：

FROM <xxxx>

ARG PROMETHEUS_VERSION=2.17.2

# Dependencies
RUN apk add --update --no-cache \
    ruby=~2 \
    curl=~7

# Download prometheus
RUN curl -k -LSs --output /tmp/prometheus.tar.gz \
    https://github.com/prometheus/prometheus/releases/download/v${PROMETHEUS_VERSION}/prometheus-${PROMETHEUS_VERSION}.linux-amd64.tar.gz && \
    tar -C /tmp --strip-components=1 -zoxf /tmp/prometheus.tar.gz && \
    rm -f /tmp/prometheus.tar.gz && \
    mkdir -p /usr/share/prometheus && \
    mv /tmp/prometheus /bin/ && \
    mv /tmp/promtool /bin/ && \
    mv /tmp/consoles /usr/share/prometheus/consoles && \
    mv /tmp/console_libraries /usr/share/prometheus/console_libraries

# Adding config file
COPY config/ /etc/prometheus/config

# Adding Alert rule config file
COPY rules/ /etc/prometheus/rules

# Giving access to unpriviliged user to access prometheus configs
RUN ln -s /usr/share/prometheus/consoles /usr/share/prometheus/console_libraries /etc/prometheus/ && \
    mkdir -p /prometheus && \
    chown -R user:user /etc/prometheus && \
    chmod -R a+rwx /prometheus

# Adding custom entrypoint
COPY entrypoint.rb /entrypoint.rb

# Using unprivileged user
USER user

# Expose prometheus port
EXPOSE 9090

# Data volume
VOLUME [ "/prometheus" ]

# Working from data dir
WORKDIR /prometheus

# Set custom entrypoint
ENTRYPOINT [ "/entrypoint.rb" ]

# Override default CMD
CMD [ \
    "--storage.tsdb.path=/prometheus", \
    "--web.console.libraries=/usr/share/prometheus/console_libraries", \
    "--web.console.templates=/usr/share/prometheus/consoles" \
]

以前有没有人遇到过这种情况，或者可以发现潜在的问题在哪里？

Answer 1

您可以在Prometheus组合文件中设置root用户，并修复此问题，但不是很安全：

prometheus:
  image: prom/prometheus
  restart: unless-stopped
  user: root
  ....