Docker-sonarqube: RUN sysctl -w vm.max_map_count=262144 is throwing error when try to build the docker image from docker file

[KarthikGowdaUN]

Getting below error, when i try to build sonarqube image locally from docker file, this line is causing the issue RUN sysctl -w vm.max_map_count=262144

Step 7/12 : RUN sysctl -w vm.max_map_count=262144
---> Running in dfc9a807faa1
sysctl: setting key "vm.max_map_count": Read-only file system
The command '/bin/sh -c sysctl -w vm.max_map_count=262144' returned a non-zero code: 255

Below is my dockerfile code.

FROM openjdk:8

ENV SONAR_VERSION=7.8 \
SONARQUBE_HOME=/opt/sonarqube \
# Database configuration
# Defaults to using H2
# DEPRECATED. Use -v sonar.jdbc.username=... instead
# Drop these in the next release, also in the run script
SONARQUBE_JDBC_USERNAME=sonar \
SONARQUBE_JDBC_PASSWORD=sonar \
SONARQUBE_JDBC_URL=

Http port

EXPOSE 9000

RUN groupadd -r sonarqube && useradd -r -g sonarqube sonarqube

grab gosu for easy step-down from root

RUN set -x \
&& wget -O /usr/local/bin/gosu "https://github.com/tianon/gosu/releases/download/1.10/gosu-$(dpkg --print-architecture)" \
&& wget -O /usr/local/bin/gosu.asc "https://github.com/tianon/gosu/releases/download/1.10/gosu-$(dpkg --print-architecture).asc" \
&& export GNUPGHOME="$(mktemp -d)" \
&& (gpg --batch --keyserver ha.pool.sks-keyservers.net --recv-keys B42F6819007F00F88E364FD4036A9C25BF357DD4 \
|| gpg --batch --keyserver ipv4.pool.sks-keyservers.net --recv-keys B42F6819007F00F88E364FD4036A9C25BF357DD4) \
&& gpg --batch --verify /usr/local/bin/gosu.asc /usr/local/bin/gosu \
&& rm -rf "$GNUPGHOME" /usr/local/bin/gosu.asc \
&& chmod +x /usr/local/bin/gosu \
&& gosu nobody true

RUN set -x \
# pub 2048R/D26468DE 2015-05-25
# Key fingerprint = F118 2E81 C792 9289 21DB CAB4 CFCA 4A29 D264 68DE
# uid sonarsource_deployer (Sonarsource Deployer) [e-mail]
# sub 2048R/06855C1D 2015-05-25
&& (gpg --batch --keyserver ha.pool.sks-keyservers.net --recv-keys F1182E81C792928921DBCAB4CFCA4A29D26468DE \
|| gpg --batch --keyserver ipv4.pool.sks-keyservers.net --recv-keys F1182E81C792928921DBCAB4CFCA4A29D26468DE) \
&& cd /opt \
&& curl -o sonarqube.zip -fSL https://binaries.sonarsource.com/Distribution/sonarqube/sonarqube-$SONAR_VERSION.zip \
&& curl -o sonarqube.zip.asc -fSL https://binaries.sonarsource.com/Distribution/sonarqube/sonarqube-$SONAR_VERSION.zip.asc \
&& gpg --batch --verify sonarqube.zip.asc sonarqube.zip \
&& unzip sonarqube.zip \
&& mv sonarqube-$SONAR_VERSION sonarqube \
&& chown -R sonarqube:sonarqube sonarqube \
&& rm sonarqube.zip* \
&& rm -rf $SONARQUBE_HOME/bin/*

RUN sysctl -w vm.max_map_count=262144

VOLUME "$SONARQUBE_HOME/data"

WORKDIR $SONARQUBE_HOME
COPY run.sh $SONARQUBE_HOME/bin/
USER sonarqube
ENTRYPOINT ["./bin/run.sh"]

[nicoherbigde]

Hi, I encountered the same problem a few hours ago when upgrading SonarQube to version 7.8. The solution is, to do this configuration sysctl -w vm.max_map_count=262144 on the host system and not inside the Docker container. Please consider that this setting is reseted after a restart of the host system.

To save this setting permanently, the following line must be added to the /etc/sysctl.conf file.

vm.max_map_count=262144

Alternatively, the configuration can also be saved in a separate file under the path /etc/sysctl.d/, e. g. /etc/sysctl.d/99-docker.conf. After a restart, this setting should have been applied. To check this, run sysctl vm.max_map_count.

I hope the solution helps you.

See also, https://github.com/spujadas/elk-docker/issues/92#issuecomment-263152557

[jcoeltjen]

If you use Kubernetes: I created a PR against the Sonarqube Helm chart that also addresses this issue:
https://github.com/helm/charts/pull/15017.
Even if you don't use Helm you can use the same solution in regular deployment manifests.

[jcoeltjen]

I would propose to close this ticket here as setting sysctl settings via Dockerfile is not supported by Docker and not an issue in the Sonarqube Dockerfiles.
For running locally you can use the --sysctl parameter when using docker run.

[KarthikGowdaUN]

@jcoeltjen , actually I had got this sonarqube instance 7.8 up and running in azure, but few days later faced that vm.max_map_count issue, tried updating it from bash, but faced some error "Readonly file cannot be modified", Now i'm trying to build a docker image with 'vm.max_map_count' fixed in the image itself.. But its not working as you said..

Is there a way, I can update this in azure, currently my "app service" is holding the sonarqube docker container.

Or even if you could tell me how to get this updated from an yaml would also be fine, i'm very new to this yaml.

[jcoeltjen]

@KarthikGowdaUN What service are you using exactly?
Web App, Web App for Containers, Container Instances, etc?
Maybe there is a way to set sysctl settings in one of these.

Update: I don't see any way to set non namespaces kernel settings in any of these services.
You may have to use Kubernetes or a plain VM. Keep in mind that when running on Kubernetes with active Pod Security Policies you might run into issues when trying to start a privileged container (depending on your policies).

[hsmiranda]

Hi, I encountered the same problem a few hours ago when upgrading SonarQube to version 7.8. The solution is, to do this configuration sysctl -w vm.max_map_count=262144 on the host system and not inside the Docker container. Please consider that this setting is reseted after a restart of the host system.

To save this setting permanently, the following line must be added to the /etc/sysctl.conf file.

vm.max_map_count=262144

Alternatively, the configuration can also be saved in a separate file under the path /etc/sysctl.d/, e. g. /etc/sysctl.d/99-docker.conf. After a restart, this setting should have been applied. To check this, run sysctl vm.max_map_count.

I hope the solution helps you.

See also, spujadas/elk-docker#92 (comment)

Work with me, thanks!

[pierre-guillot-sonarsource]

I'm closing this as this issue is not related to Docker, there is nothing we can do from the image to address that. The only thing that we could do is improve the documentation to specify what need to be done on the host.

[WingsLikeEagles]

Version 7.3 of ElasticSearch has resolved this by disabling mmapfs. Please add a setting via env var as directed by this page..
https://www.elastic.co/guide/en/elasticsearch/reference/current/index-modules-store.html

node.store.allow_mmap = false

[pierre-guillot-sonarsource]

If you disable mmap, the store will use niofs which It is not recommended on Windows because of a bug in the SUN Java implementation. The last solution left is simplefs, which has bad performance.

So, better increase the memory settings.

[acdha]

@pierre-guillot-sonarsource I can understand that as not having it by default, but this is in the context of Docker where the current sonarqube image cannot be used on popular environments (e.g. AWS ECS) and will never run on Windows.

[telliad23]

I just tested sonarqube 7.9.1 on ECS Fargate and it seems to work now. Did Sonar make any changes to its source code?

[pierre-guillot-sonarsource]

Nope. The 7.9.1 will never change. Next LTS version will be 7.9.2 :)

[telliad23]

My bad, apparently the checks are not enforced only if your Sonarqube server is using H2 DB

[jbrantly]

As a stopgap, is there a blessed path to modifying the Elasticsearch configuration as either part of the image or the container? The closest thing I could find is this idea of modifying the Elasticsearch startup script to modify the config which seems a bit messy.

[jbrantly]

I picked this back up last week and was able to successfully run on Azure App Service for Linux by using a hint from this comment and the following discussion.

I just modified my dockerfile to copy in a custom sonar.properties.

COPY ./sonar.properties /opt/sonarqube/conf/

In that properties file I disabled mmap in ElasticSearch.

sonar.search.javaAdditionalOpts=-Dnode.store.allow_mmap=false

[yj0930]

sonar.search.javaAdditionalOpts=-Dnode.store.allow_mmapfs=false worked for me