2019独角兽企业重金招聘Python工程师标准>>>

在升级到kernel-3.17的centos-6.5上安装docker，直接执行以下命令：

yum install golang
yum install docker-io
chkconfig add docker
service docker start

但出现了以下错误：

[root@osd2 ~]# service docker start
Starting cgconfig service: Error: cannot mount memory to /cgroup/memory: No such file or directory
/sbin/cgconfigparser; error loading /etc/cgconfig.conf: Cgroup mounting failed
Failed to parse /etc/cgconfig.conf                         [FAILED]
Starting docker:                                       [  OK  ]
[root@osd2 ~]# service docker start
[root@osd2 ~]# service docker status
docker dead but pid file exists

查了一下cgconfig：

[root@osd2 ~]#  /etc/init.d/cgconfig status
Stopped
[root@osd2 ~]# /etc/init.d/cgconfig start
Starting cgconfig service: Error: cannot mount memory to /cgroup/memory: No such file or directory
/sbin/cgconfigparser; error loading /etc/cgconfig.conf: Cgroup mounting failed
Failed to parse /etc/cgconfig.conf                         [FAILED]
[root@osd2 ~]# ls /cgroup/
blkio  devices  freezer  memory  net_cls

memory是有的，但就是出错，需要修改：

[root@osd2 ~]# cat /etc/cgconfig.conf
#
#  Copyright IBM Corporation. 2007
#
#  Authors: Balbir Singh <balbir@linux.vnet.ibm.com>
#  This program is free software; you can redistribute it and/or modify it
#  under the terms of version 2.1 of the GNU Lesser General Public License
#  as published by the Free Software Foundation.
#
#  This program is distributed in the hope that it would be useful, but
#  WITHOUT ANY WARRANTY; without even the implied warranty of
#  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
#
# See man cgconfig.conf for further details.
#
# By default, mount all controllers to /cgroup/<controller>mount {cpuset  = /cgroup/cpuset;cpu   = /cgroup/cpu;cpuacct  = /cgroup/cpuacct;
#   memory  = /cgroup/memory;devices   = /cgroup/devices;freezer  = /cgroup/freezer;net_cls  = /cgroup/net_cls;blkio    = /cgroup/blkio;
}

再次启动cgconfig，一切正常。但重启docker，依然报错：

[root@osd2 ~]# service docker status
docker dead but pid file exists[root@osd2 ~]# tailf /var/log/docker
\nMon Jan  5 14:04:33 CST 2015\n
2015/01/05 14:04:33 docker daemon: 1.3.2 39fa2fa/1.3.2; execdriver: native; graphdriver:
[910cf963] +job serveapi(unix:///var/run/docker.sock)
[910cf963] +job init_networkdriver()
[info] Listening for HTTP on unix (/var/run/docker.sock)
Unable to enable network bridge NAT: iptables failed: iptables -I POSTROUTING -t nat -s 172.17.42.1/16 ! -o docker0 -j MASQUERADE: iptables v1.4.7: can't initialize iptables table `nat': Table does not exist (do you need to insmod?)
Perhaps iptables or your kernel needs to be upgraded.(exit status 3)
[910cf963] -job init_networkdriver() = ERR (1)
2015/01/05 14:04:33  (exit status 3)

日志显示无法创建nat网桥，看了一下正常的docker环境和modules：

[root@lm backup]# lsmod | grep nat
ebtable_nat             2009  0
ebtables               18135  1 ebtable_nat
iptable_nat             6051  1
nf_nat                 23316  2 ipt_MASQUERADE,iptable_nat
nf_conntrack_ipv4       9506  4 iptable_nat,nf_nat
nf_conntrack           80390  6 xt_conntrack,xt_state,ipt_MASQUERADE,iptable_nat,nf_nat,nf_conntrack_ipv4
ip_tables              17831  3 iptable_nat,iptable_mangle,iptable_filter[root@lm backup]# find /lib/modules/2.6.32-504.1.3.el6.x86_64/ -name "*nat*"
/lib/modules/2.6.32-504.1.3.el6.x86_64/kernel/net/ipv4/netfilter/nf_nat_proto_dccp.ko
/lib/modules/2.6.32-504.1.3.el6.x86_64/kernel/net/ipv4/netfilter/nf_nat_proto_udplite.ko
/lib/modules/2.6.32-504.1.3.el6.x86_64/kernel/net/ipv4/netfilter/nf_nat_ftp.ko
/lib/modules/2.6.32-504.1.3.el6.x86_64/kernel/net/ipv4/netfilter/nf_nat_proto_sctp.ko
/lib/modules/2.6.32-504.1.3.el6.x86_64/kernel/net/ipv4/netfilter/nf_nat_proto_gre.ko
/lib/modules/2.6.32-504.1.3.el6.x86_64/kernel/net/ipv4/netfilter/nf_nat_sip.ko
/lib/modules/2.6.32-504.1.3.el6.x86_64/kernel/net/ipv4/netfilter/nf_nat_tftp.ko
/lib/modules/2.6.32-504.1.3.el6.x86_64/kernel/net/ipv4/netfilter/nf_nat_pptp.ko
/lib/modules/2.6.32-504.1.3.el6.x86_64/kernel/net/ipv4/netfilter/nf_nat.ko
/lib/modules/2.6.32-504.1.3.el6.x86_64/kernel/net/ipv4/netfilter/iptable_nat.ko
/lib/modules/2.6.32-504.1.3.el6.x86_64/kernel/net/ipv4/netfilter/nf_nat_snmp_basic.ko
/lib/modules/2.6.32-504.1.3.el6.x86_64/kernel/net/ipv4/netfilter/nf_nat_amanda.ko
/lib/modules/2.6.32-504.1.3.el6.x86_64/kernel/net/ipv4/netfilter/nf_nat_h323.ko
/lib/modules/2.6.32-504.1.3.el6.x86_64/kernel/net/ipv4/netfilter/nf_nat_irc.ko
/lib/modules/2.6.32-504.1.3.el6.x86_64/kernel/net/bridge/netfilter/ebt_snat.ko
/lib/modules/2.6.32-504.1.3.el6.x86_64/kernel/net/bridge/netfilter/ebt_dnat.ko
/lib/modules/2.6.32-504.1.3.el6.x86_64/kernel/net/bridge/netfilter/ebtable_nat.ko
/lib/modules/2.6.32-504.1.3.el6.x86_64/kernel/net/sched/act_nat.ko
/lib/modules/2.6.32-504.1.3.el6.x86_64/kernel/drivers/net/natsemi.ko
/lib/modules/2.6.32-504.1.3.el6.x86_64/kernel/drivers/net/phy/national.ko

编译过内核的环境：

[root@osd2 /]# lsmod | grep nat
ebtable_nat             2071  0
ebtables               26518  1 ebtable_nat[root@osd2 modprobe.d]# find /lib/modules/3.17.4/ -name "*nat*"
/lib/modules/3.17.4/kernel/net/sched/act_nat.ko
/lib/modules/3.17.4/kernel/net/bridge/netfilter/ebt_snat.ko
/lib/modules/3.17.4/kernel/net/bridge/netfilter/ebt_dnat.ko
/lib/modules/3.17.4/kernel/net/bridge/netfilter/ebtable_nat.ko
/lib/modules/3.17.4/kernel/drivers/net/ethernet/natsemi
/lib/modules/3.17.4/kernel/drivers/net/ethernet/natsemi/natsemi.ko
/lib/modules/3.17.4/kernel/drivers/net/phy/national.ko

缺少了nat模块，才引起了上述错误，需要重新编译内核或使用旧内核。

或者重新编译内核，打开cgroup的memory control项：
General Setup->Control Group Support