带有 Ubuntu 20.10 的 Docker：`strconv.Atoi：解析“0-beta1”：无效语法`

Question

我只是使用通常的方法更新安装在我机器上的所有软件包：

sudo apt update && sudo apt upgrade -y && sudo apt autoremove -y

重新启动系统后，我看到我的 Docker 容器从执行中消失了，然后我决定启动通常的hello-world容器。我检索到以下错误消息。

sudouser@machine:~$ sudo docker run hello-world
docker: Error response from daemon: AppArmor enabled on system but the docker-default profile could not be loaded: strconv.Atoi: parsing "0-beta1": invalid syntax.
ERRO[0004] error waiting for container: context canceled 

尝试过的解决方案

• 卸载并重新安装 Docker：无变化。

有用的信息

Distributor ID: Ubuntu
Description:    Ubuntu Groovy Gorilla (development branch)
Release:    20.10
Codename:   groovy
Kernel:     GNU/Linux 5.8.0-19-generic x86_64

Answer 1

您好，我通过在 /etc/apparmor.d 目录中手动添加 docker 文件解决了该问题：

$ /etc/apparmor.d$ cat docker 
#include <tunables/global>
profile docker-default flags=(attach_disconnected,mediate_deleted) {
  #include <abstractions/base>
  network,
  capability,
  file,
  umount,
  deny @{PROC}/* w,   # deny write for all files directly in /proc (not in a subdir)
  # deny write to files not in /proc/<number>/** or /proc/sys/**
  deny @{PROC}/{[^1-9],[^1-9][^0-9],[^1-9s][^0-9y][^0-9s],[^1-9][^0-9][^0-9][^0-9]*}/** w,
  deny @{PROC}/sys/[^k]** w,  # deny /proc/sys except /proc/sys/k* (effectively /proc/sys/kernel)
  deny @{PROC}/sys/kernel/{?,??,[^s][^h][^m]**} w,  # deny everything except shm* in /proc/sys/kernel/
  deny @{PROC}/sysrq-trigger rwklx,
  deny @{PROC}/mem rwklx,
  deny @{PROC}/kmem rwklx,
  deny @{PROC}/kcore rwklx,
  deny mount,
  deny /sys/[^f]*/** wklx,
  deny /sys/f[^s]*/** wklx,
  deny /sys/fs/[^c]*/** wklx,
  deny /sys/fs/c[^g]*/** wklx,
  deny /sys/fs/cg[^r]*/** wklx,
  deny /sys/firmware/efi/efivars/** rwklx,
  deny /sys/kernel/security/** rwklx,
  # suppress ptrace denials when using 'docker ps' or using 'ps' inside a container ptrace (trace,read) peer=docker-default,
}

$ /etc/init.d/apparmor restart
$ docker run hello-world
Hello from Docker!
This message shows that your installation appears to be working correctly.
To generate this message, Docker took the following steps:
 1. The Docker client contacted the Docker daemon.
 2. The Docker daemon pulled the "hello-world" image from the Docker Hub.
    (amd64)
 3. The Docker daemon created a new container from that image which runs the
    executable that produces the output you are currently reading.
 4. The Docker daemon streamed that output to the Docker client, which sent it
    to your terminal.
To try something more ambitious, you can run an Ubuntu container with:
 $ docker run -it ubuntu bash
Share images, automate workflows, and more with a free Docker ID:
 https://hub.docker.com/
For more examples and ideas, visit:
 https://docs.docker.com/get-started/