my-vault/04_Archive/Projects/Airport/oracle/docker can't run.md

Summary of the Problem and Solution

---

Problem Overview

You were attempting to run an Oracle 11g Docker container using the command:

docker run -idt --name oracle -h oracle --privileged=true -p 1521:1521 -p 2222:22 \
lhrbest/oracle_11g_ee_lhr_11.2.0.4:2.0 init

• Issue Experienced:
  • The Docker container exited immediately after starting, without any error messages.
  • The exit code was 139, indicating a segmentation fault (SIGSEGV).
  • The issue occurred on a Debian system but not on OpenSUSE.

---

Root Cause

The segmentation fault was due to the way modern Linux kernels handle vsyscall (virtual system call):

• vsyscall Deprecation:

  • Modern kernels have deprecated vsyscall in favor of vDSO (virtual dynamic shared object) for security reasons.
  • By default, vsyscall might be disabled or set to a mode incompatible with older applications.

• Impact on Oracle 11g:

  • Oracle 11g, being legacy software, relies on the old vsyscall mechanism for certain operations.
  • Without proper vsyscall support, Oracle binaries can crash with a segmentation fault.

• Difference Between Systems:

  • OpenSUSE may have vsyscall support enabled or set to emulate by default.
  • Debian, especially with newer kernels, has vsyscall disabled or set to a mode that doesn't support the required legacy behavior.

---

Solution

Enable vsyscall Emulation on the Debian System:

1. Verify Current vsyscall Mapping:

   sudo grep vsyscall /proc/self/maps
   

   • If no output is returned, vsyscall is not currently mapped.

2. Edit GRUB Configuration:

   • Open the GRUB configuration file:

     sudo nano /etc/default/grub
     

   • Locate the line starting with GRUB_CMDLINE_LINUX_DEFAULT.

   • Append vsyscall=emulate to the existing parameters within the quotes.

     Example:

     GRUB_CMDLINE_LINUX_DEFAULT="quiet splash vsyscall=emulate"
     

3. Update GRUB Settings:

   • Apply the changes by updating GRUB:

     sudo update-grub
     

4. Reboot the System:

   • Restart your machine to apply the new kernel parameter:

     sudo reboot
     

5. Confirm vsyscall is Enabled:

   • After rebooting, check if vsyscall is now mapped:

     sudo grep vsyscall /proc/self/maps
     

   • You should see an output similar to:

     ffffffffff600000-ffffffffff601000 r-xp 00000000 00:00 0                  [vsyscall]
     

6. Run the Docker Container Again:

   • With vsyscall emulation enabled, attempt to start the Oracle container:

     docker run -idt --name oracle -h oracle --privileged=true --shm-size=2g \
     -p 1521:1521 -p 2222:22 lhrbest/oracle_11g_ee_lhr_11.2.0.4:2.0 init
     

   • The container should now start successfully without exiting.

---

Explanation of the Solution

• vsyscall=emulate Kernel Parameter:

  • Tells the kernel to emulate the old vsyscall behavior, allowing legacy applications to function correctly.
  • Balances compatibility with security, as emulation is safer than direct mapping.

• Why It Works:

  • Restores the expected environment for Oracle 11g, preventing segmentation faults caused by missing vsyscall support.

---

Additional Considerations

• Security Implications:

  • Enabling vsyscall emulation is generally safe but reintroduces some legacy code paths.
  • The risk is minimal for most users, but it's important to keep the system updated.

• Alternate Solutions:

  • Upgrade Oracle Version:
    • Consider using a newer version of Oracle that doesn't rely on vsyscall.
  • Use an Older Kernel:
    • Downgrading the kernel to a version where vsyscall is enabled by default.
    • Not recommended due to potential security vulnerabilities.

• Documentation and References:

  • Similar issues and solutions have been documented in various repositories:
    • JiscSD/rdss-archivematica Issue #65
    • Enalean/docker-tuleap-aio Issue #57
    • moby/moby Issue #28705

---

Summary

• Problem:

  • The Oracle 11g Docker container was exiting with a segmentation fault on Debian due to vsyscall being disabled in the kernel.

• Solution:

  • Enabling vsyscall emulation by adding vsyscall=emulate to the kernel boot parameters in GRUB.
  • Updating GRUB and rebooting the system applied the changes.
  • The container then started successfully.

---

By adjusting the kernel parameter to enable vsyscall emulation, you resolved the compatibility issue between Oracle 11g and the modern Debian kernel, allowing the Docker container to run without errors.

---

If you have any further questions or need assistance with other issues, feel free to ask!