有一些内核缺少 Docker 所需的核心模块overlayfs、bridge、iptables 相关等所以在安装docker之前可以先检查一下。脚本可以检测Kernel配置是否符合Docker的运行要求源地址https://github.com/moby/moby/blob/master/contrib/check-config.shcheck-config.sh脚本内容如下#!/usr/bin/env sh set -e EXITCODE0 # bits of this were adapted from lxc-checkconfig # see also https://github.com/lxc/lxc/blob/lxc-1.0.2/src/lxc/lxc-checkconfig.in possibleConfigs /proc/config.gz /boot/config-$(uname -r) /usr/src/linux-$(uname -r)/.config /usr/src/linux/.config if [ $# -gt 0 ]; then CONFIG$1 else : ${CONFIG:/proc/config.gz} fi if ! command -v zgrep /dev/null 21; then zgrep() { zcat $2 | grep $1 } fi useColortrue if [ $NO_COLOR 1 ] || [ ! -t 1 ]; then useColorfalse fi kernelVersion$(uname -r) kernelMajor${kernelVersion%%.*} kernelMinor${kernelVersion#$kernelMajor.} kernelMinor${kernelMinor%%.*} is_set() { zgrep CONFIG_$1[y|m] $CONFIG /dev/null } is_set_in_kernel() { zgrep CONFIG_$1y $CONFIG /dev/null } is_set_as_module() { zgrep CONFIG_$1m $CONFIG /dev/null } color() { # if stdout is not a terminal, then dont do color codes. if [ $useColor false ]; then return 0 fi codes if [ $1 bold ]; then codes1 shift fi if [ $# -gt 0 ]; then code case $1 in # see https://en.wikipedia.org/wiki/ANSI_escape_code#Colors black) code30 ;; red) code31 ;; green) code32 ;; yellow) code33 ;; blue) code34 ;; magenta) code35 ;; cyan) code36 ;; white) code37 ;; esac if [ $code ]; then codes${codes:$codes;}$code fi fi printf \033[%sm $codes } wrap_color() { text$1 shift color $ printf %s $text color reset echo } wrap_good() { echo $(wrap_color $1 white): $(wrap_color $2 green) } wrap_bad() { echo $(wrap_color $1 bold): $(wrap_color $2 bold red) } wrap_warning() { wrap_color 2 $* red } check_flag() { if is_set_in_kernel $1; then wrap_good CONFIG_$1 enabled elif is_set_as_module $1; then wrap_good CONFIG_$1 enabled (as module) else wrap_bad CONFIG_$1 missing EXITCODE1 fi } check_flags() { for flag in $; do printf -- - check_flag $flag done } check_command() { if command -v $1 /dev/null 21; then wrap_good $1 command available else wrap_bad $1 command missing EXITCODE1 fi } check_device() { if [ -c $1 ]; then wrap_good $1 present else wrap_bad $1 missing EXITCODE1 fi } check_sysctl() { val$(sysctl -n $1) want$2 if [ $val $want ]; then wrap_good sysctl $1 enabled else wrap_bad sysctl $1 disabled fi } if [ ! -e $CONFIG ]; then wrap_warning warning: $CONFIG does not exist, searching other paths for kernel config ... for tryConfig in $possibleConfigs; do if [ -e $tryConfig ]; then CONFIG$tryConfig break fi done if [ ! -e $CONFIG ]; then wrap_warning error: cannot find kernel config wrap_warning try running this script again, specifying the kernel config: wrap_warning CONFIG/path/to/kernel/.config $0 or $0 /path/to/kernel/.config exit 1 fi fi wrap_color info: reading kernel config from $CONFIG ... white echo echo Generally Necessary: printf -- - if [ $(stat -f -c %t /sys/fs/cgroup 2 /dev/null) 63677270 ]; then wrap_good cgroup hierarchy cgroupv2 cgroupv2ControllerFile/sys/fs/cgroup/cgroup.controllers if [ -f $cgroupv2ControllerFile ]; then echo Controllers: for controller in cpu cpuset io memory pids; do if grep -qE (^| )$controller($| ) $cgroupv2ControllerFile; then echo - $(wrap_good $controller available) else echo - $(wrap_bad $controller missing) fi done else wrap_bad $cgroupv2ControllerFile nonexistent?? fi # TODO find an efficient way to check if cgroup.freeze exists in subdir else cgroupSubsystemDir$(sed -rne /^[^ ] ([^ ]) cgroup ([^ ]*,)?(cpu|cpuacct|cpuset|devices|freezer|memory)[, ].*$/ { s//\1/p; q } /proc/mounts) cgroupDir$(dirname $cgroupSubsystemDir) if [ -d $cgroupDir/cpu ] || [ -d $cgroupDir/cpuacct ] || [ -d $cgroupDir/cpuset ] || [ -d $cgroupDir/devices ] || [ -d $cgroupDir/freezer ] || [ -d $cgroupDir/memory ]; then echo $(wrap_good cgroup hierarchy properly mounted) [$cgroupDir] else if [ $cgroupSubsystemDir ]; then echo $(wrap_bad cgroup hierarchy single mountpoint!) [$cgroupSubsystemDir] else wrap_bad cgroup hierarchy nonexistent?? fi EXITCODE1 echo $(wrap_color (see https://github.com/tianon/cgroupfs-mount) yellow) fi fi if [ $(cat /sys/module/apparmor/parameters/enabled 2 /dev/null) Y ]; then printf -- - if command -v apparmor_parser /dev/null 21; then wrap_good apparmor enabled and tools installed else wrap_bad apparmor enabled, but apparmor_parser missing printf if command -v apt-get /dev/null 21; then wrap_color (use apt-get install apparmor to fix this) elif command -v yum /dev/null 21; then wrap_color (your best bet is yum install apparmor-parser) else wrap_color (look for an apparmor package for your distribution) fi EXITCODE1 fi fi check_flags \ NAMESPACES NET_NS PID_NS IPC_NS UTS_NS \ CGROUPS CGROUP_CPUACCT CGROUP_DEVICE CGROUP_FREEZER CGROUP_SCHED CPUSETS MEMCG \ KEYS \ VETH BRIDGE BRIDGE_NETFILTER \ IP_NF_FILTER IP_NF_MANGLE IP_NF_TARGET_MASQUERADE \ IP6_NF_FILTER IP6_NF_MANGLE IP6_NF_TARGET_MASQUERADE \ NETFILTER_XT_MATCH_ADDRTYPE \ NETFILTER_XT_MATCH_CONNTRACK \ NETFILTER_XT_MATCH_IPVS \ NETFILTER_XT_MARK \ IP_NF_RAW IP_NF_NAT NF_NAT \ IP6_NF_RAW IP6_NF_NAT NF_NAT \ POSIX_MQUEUE # (POSIX_MQUEUE is required for bind-mounting /dev/mqueue into containers) if [ $kernelMajor -lt 4 ] || ([ $kernelMajor -eq 4 ] [ $kernelMinor -lt 8 ]); then check_flags DEVPTS_MULTIPLE_INSTANCES fi if [ $kernelMajor -lt 5 ] || [ $kernelMajor -eq 5 -a $kernelMinor -le 1 ]; then check_flags NF_NAT_IPV4 fi if [ $kernelMajor -lt 5 ] || [ $kernelMajor -eq 5 -a $kernelMinor -le 2 ]; then check_flags NF_NAT_NEEDED fi # check availability of BPF_CGROUP_DEVICE support if [ $kernelMajor -ge 5 ] || ([ $kernelMajor -eq 4 ] [ $kernelMinor -ge 15 ]); then check_flags CGROUP_BPF fi echo echo Optional Features: { check_flags USER_NS } { check_flags SECCOMP check_flags SECCOMP_FILTER } { check_flags CGROUP_PIDS } { # Kernel v5.8 removes MEMCG_SWAP_ENABLED and deprecates MEMCG_SWAP. if [ $kernelMajor -lt 5 ] || [ $kernelMajor -eq 5 -a $kernelMinor -lt 8 ]; then CODE${EXITCODE} check_flags MEMCG_SWAP MEMCG_SWAP_ENABLED # FIXME this check is cgroupv1-specific if [ -e /sys/fs/cgroup/memory/memory.memsw.limit_in_bytes ]; then echo $(wrap_color (cgroup swap accounting is currently enabled) bold black) EXITCODE${CODE} elif is_set MEMCG_SWAP ! is_set MEMCG_SWAP_ENABLED; then echo $(wrap_color (cgroup swap accounting is currently not enabled, you can enable it by setting boot option swapaccount1) bold black) fi else # Kernel v5.8 enables swap accounting by default. echo $(wrap_color (cgroup swap accounting is currently enabled) bold black) fi } { if is_set LEGACY_VSYSCALL_NATIVE; then printf -- - wrap_bad CONFIG_LEGACY_VSYSCALL_NATIVE enabled echo $(wrap_color (dangerous, provides an ASLR-bypassing target with usable ROP gadgets.) bold black) elif is_set LEGACY_VSYSCALL_EMULATE; then printf -- - wrap_good CONFIG_LEGACY_VSYSCALL_EMULATE enabled elif is_set LEGACY_VSYSCALL_NONE; then printf -- - wrap_bad CONFIG_LEGACY_VSYSCALL_NONE enabled echo $(wrap_color (containers using eglibc 2.13 will not work. Switch to bold black) echo $(wrap_color CONFIG_VSYSCALL_[NATIVE|EMULATE] or use vsyscall[native|emulate] bold black) echo $(wrap_color on kernel command line. Note that this will disable ASLR for the, bold black) echo $(wrap_color VDSO which may assist in exploiting security vulnerabilities.) bold black) # else Older kernels (prior to 3dc33bd30f3e, released in v4.40-rc1) do # not have these LEGACY_VSYSCALL options and are effectively # LEGACY_VSYSCALL_EMULATE. Even older kernels are presumably # effectively LEGACY_VSYSCALL_NATIVE. fi } if [ $kernelMajor -lt 4 ] || ([ $kernelMajor -eq 4 ] [ $kernelMinor -le 5 ]); then check_flags MEMCG_KMEM fi if [ $kernelMajor -lt 3 ] || ([ $kernelMajor -eq 3 ] [ $kernelMinor -le 18 ]); then check_flags RESOURCE_COUNTERS fi if [ $kernelMajor -lt 3 ] || ([ $kernelMajor -eq 3 ] [ $kernelMinor -le 13 ]); then netprioNETPRIO_CGROUP else netprioCGROUP_NET_PRIO fi if [ $kernelMajor -lt 5 ]; then check_flags IOSCHED_CFQ CFQ_GROUP_IOSCHED fi check_flags \ BLK_CGROUP BLK_DEV_THROTTLING \ CGROUP_PERF \ CGROUP_HUGETLB \ NET_CLS_CGROUP $netprio \ CFS_BANDWIDTH FAIR_GROUP_SCHED \ IP_NF_TARGET_REDIRECT \ IP_SCTP \ IP_VS \ IP_VS_NFCT \ IP_VS_PROTO_TCP \ IP_VS_PROTO_UDP \ IP_VS_RR \ SECURITY_SELINUX \ SECURITY_APPARMOR check_flags \ NFT_CT \ NFT_FIB_IPV4 \ NFT_FIB_IPV6 \ NFT_FIB \ NFT_MASQ \ NFT_NAT \ NF_TABLES if ! is_set EXT4_USE_FOR_EXT2; then check_flags EXT3_FS EXT3_FS_XATTR EXT3_FS_POSIX_ACL EXT3_FS_SECURITY if ! is_set EXT3_FS || ! is_set EXT3_FS_XATTR || ! is_set EXT3_FS_POSIX_ACL || ! is_set EXT3_FS_SECURITY; then echo $(wrap_color (enable these ext3 configs if you are using ext3 as backing filesystem) bold black) fi fi check_flags EXT4_FS EXT4_FS_POSIX_ACL EXT4_FS_SECURITY if ! is_set EXT4_FS || ! is_set EXT4_FS_POSIX_ACL || ! is_set EXT4_FS_SECURITY; then if is_set EXT4_USE_FOR_EXT2; then echo $(wrap_color enable these ext4 configs if you are using ext3 or ext4 as backing filesystem bold black) else echo $(wrap_color enable these ext4 configs if you are using ext4 as backing filesystem bold black) fi fi echo - Network Drivers: echo - \$(wrap_color bridge blue)\: check_sysctl net.ipv4.ip_forward 1 | sed s/^/ - / check_sysctl net.ipv6.conf.all.forwarding 1 | sed s/^/ - / check_sysctl net.ipv6.conf.default.forwarding 1 | sed s/^/ - / echo - \$(wrap_color overlay blue)\: check_flags VXLAN BRIDGE_VLAN_FILTERING | sed s/^/ / echo Optional (for encrypted networks): check_flags CRYPTO CRYPTO_AEAD CRYPTO_GCM CRYPTO_SEQIV CRYPTO_GHASH \ XFRM XFRM_USER XFRM_ALGO INET_ESP NETFILTER_XT_MATCH_BPF | sed s/^/ / if [ $kernelMajor -lt 5 ] || [ $kernelMajor -eq 5 -a $kernelMinor -le 3 ]; then check_flags INET_XFRM_MODE_TRANSPORT | sed s/^/ / fi echo - \$(wrap_color ipvlan blue)\: check_flags IPVLAN | sed s/^/ / echo - \$(wrap_color macvlan blue)\: check_flags MACVLAN DUMMY | sed s/^/ / echo - \$(wrap_color ftp,tftp client in container blue)\: check_flags NF_NAT_FTP NF_CONNTRACK_FTP NF_NAT_TFTP NF_CONNTRACK_TFTP | sed s/^/ / # only fail if no storage drivers available CODE${EXITCODE} EXITCODE0 STORAGE1 echo - Storage Drivers: echo - \$(wrap_color btrfs blue)\: check_flags BTRFS_FS | sed s/^/ / check_flags BTRFS_FS_POSIX_ACL | sed s/^/ / [ $EXITCODE 0 ] STORAGE0 EXITCODE0 echo - \$(wrap_color overlay blue)\: check_flags OVERLAY_FS | sed s/^/ / [ $EXITCODE 0 ] STORAGE0 EXITCODE0 echo - \$(wrap_color zfs blue)\: printf - check_device /dev/zfs printf - check_command zfs printf - check_command zpool [ $EXITCODE 0 ] STORAGE0 EXITCODE0 EXITCODE$CODE [ $STORAGE 1 ] EXITCODE1 echo check_limit_over() { if [ $(cat $1) -le $2 ]; then wrap_bad - $1 $(cat $1) wrap_color This should be set to at least $2, for example set: sysctl -w kernel/keys/root_maxkeys1000000 bold black EXITCODE1 else wrap_good - $1 $(cat $1) fi } echo Limits: check_limit_over /proc/sys/kernel/keys/root_maxkeys 10000 echo exit $EXITCODEchmod x check-config.sh./check-config.sh输出内容结果主要是两部分Generally Necessary: 表示必要的配置如果有显示missing的地方需要在内核配置中打开重新编译烧录内核以支持DockerOptional Features: 是可选配置根据需要打开。